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A cash-equivalent card-based purchasing system and its "^^^hod of 
operation, in which an information processing computer has a plurality 
of records stored in an associated storage device, each record 

including , . , , ^.^ ^ 

a unique cash-equivalent card number linked to a 
card value. A cash-equivalent card is provided to a user, the 

cash-equivalent card having encoded thereon one of the cash-equivalent 
card numbers stored in the storage device, the . , ^. ■, ^„4- 

cash^uivalent card provided in exchange for consideration equivalent 

to at least the value linked to the cash-equivalent card 
number encoded thereon. Neither the cash-equivalent card nor the 
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The invention provides a method and device for tokenless authorization 
of an electronic payment between a payor and a payee using an 
electronic 

third party identicator and at least one payor bid 

biometric sample. In a payor registration step, the payor registers 
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with 



an electronic third party identicator at least one 
registration biometric sample, and at least one payor financial 
account identifier. The payee registers a payee 

identification data with the electronic third party 

identicator. A payee bid identification data and a payor bid biometric 
sample collected from the payor's person are electronically forwarded 



to 



the third party electronic identicator. A comparator 
engine compares the bid biometric sample with at least one registered 
biometric sample for producing either a successful or failed 
identification of the payor. The comparator engine also compares the 
payee's bid identification data with a payee's registered 

identification ^. ^ ^.v. 

data for producing either a successful or failed identification of the 
payee. Once the electronic third-party identicator 
successfully identifies the payor and payee, the identicator 
electronically forwards at least one payor financial account 
identifier to the payee. An electronic financial transaction is 
then formed between the payor and payee, comprising a transaction 

amount . u- 

and a payor financial account identifier. This 

transaction is then electronically forwarded to a financial transaction 



processor for authorization. 
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A complete system for the purchasing of goods or 
information over a computer network is presented. Merchant 
computers on the network maintain databases of digital advertisements 
that are accessed by buyer computers. In response to user 
inquiries, buyer computers retrieve and display digital 
advertisements from merchant computers. A digital 

advertisement can further include a program that is interpreted by a- 
buyer's computer. The buyer computers include a means 
for a user to purchase the product described by a 

digital advertisement. If a user has not specified a means of payment 

the time of purchase, it can be requested after a purchase transaction 
is initiated. A network payment system performs payment order 
authorization in a network with untrusted switching, transmission, and 
host components. Payment orders are backed by accounts in an external 
financial system network, and the payment system obtains account 
authorizations from this external network in real-time. Payment orders 
are signed with authenticators that can be based on any combination of 

secret function of the payment order parameters, a single-use 
transaction identifier, or a specified network address. 
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Disclosed is a multifunction card system which provides a multifunction 
card capable of serving as a prepaid phone card, a 
debit card, a loyalty card, and a medical 

information card. Each card has an 
identification nvimber comprising a bank 

identification number which assists in establishing communications 
links. The card system can be accessed from any existing point-of-sale 
(POS) device. The POS device treats the card as a 
credit or debit card and routes transaction 

data to a processing hub using the banking system. The processing hub 
coordinates the various databases corresponding to the various 
functions 
o 
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AB A method and apparatus is provided for executing electronic 

transactions , ^ i , 4-„ 

with teens, especially where such transactions are limited only to 



those 



In one 
is provided in 
such as a saving 



vendors that have been approved by the teen's parents, 
embodiment, a virtual automatic teller machine (VATM) 
which funds are transferred from an existing account, 
account, checking account, or credit card account, 
to an Internet passport account. The VATM account mimics a 
bank account, i.e. it gives the user the appearance of an ATM 

machine. Functionally, the VATM allows the user to transfer funds from 
an existing account into the internet passport account. The 
VATM does this by emulating an ATM machine as it appears to the 
Automated Clearing House (ACH) system. The ACH system is a separate 
network from the Internet. Rather than acting as a trustee for 
a teen account, the invention provides a method and apparatus that 
allows a merchant to withdraw funds directly from the teen's 
account automatically at the time of purchase. In this way, the 
invention provides a system in which funds are not held, thereby 
eliminating cash advance fees and liabilities associated with 
trusteeship. A second embodiment of the invention, a global gift 
certificate, is provided. The preferred second embodiment of the 
invention is configured to appear as a debit card to 

the ACH system. In this regard, the gift certificate thus generated is 
truly global in that it is accepted anywhere it is presented. 
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A system provides an efficient way of providing electronic accounts to 
customers over a public network, in which all payments are traceable, 
i.e. anonymity is available to the degree that the customer provides an 
account number for paying for the transaction, and 

that uses as much as possible of emerging public network payment 
protocols. One embodiment of the system handles small payment from 
customers to merchants without burdening the banks 

with each small transaction by aggregating the payment at a payment 

g 
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A system for generating and transmitting summary transaction data 
includes a computer database from which information is compiled and 
forwarded to a requesting party automatically, i.e., without the need 
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interface with a human operator. A party having access to a prepaid 
transaction account number may access the host 

computer from a remote location and interactively request transaction 
information pertaining to the account using virtually any communication 
modality. The computer is suitably configured to communicate with one 

more of the foregoing communication modalities and to automatically 
compile and transmit the summary data to a requested destination, for 
example, to a PC . The computer may further be configured to allow the 
requesting party to select among various formats to configure the form 
of the summary data. Summary transaction data may be generated and 
transmitted for virtually any type of prepaid transaction card 
, including phone cards, travel, credit 

cards, stored value (e.g., smart cards) 

cards, and the like. 
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AB An electronic payment system in which a buyer 

purchases a product by sending an electronic payment 

order to a seller is enhanced to provide product survey 
information. An additional entity, an evaluator, collects 

product survey information from buyers that have 
previously purchased products from the 

seller and provides product survey information to 

prospective buyers upon request. Various schemes are disclosed 
for allowing the evaluator to verify that a buyer providing 

product survey information has actually purchased the 

product from the seller. In one verification scheme, 

the buyer generates an authentication code as a one-way 
function of a randomly generated secret value and includes the 
authentication code in the payment order. When the buyer later 
provides survey information to the evaluator, it includes the secret 
value along with the survey information. The evaluator verifies the 
purchase transaction by presenting the secret value along with 
information identifying the transaction to the buyer's billing 
system. The buyer's billing system retrieves the 

authentication code from the transaction information it received from 

the seller and compares it with the code regenerated from the 

secret value using the one-way function. The buyer's billing 

system communicates the comparison results to the evaluator, which uses 

the survey information if it is verified as relating to an actual 

transaction between the buyer and the seller. In 

another verification scheme, the evaluator presents only 

transaction-identifying information to the buyer's billing 

system. In yet another verification scheme, the seller signs 

the payment order and returns the signed payment order as a proof of 

purchase to the buyer, which presents the proof of purchase to 

the evaluator. 
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A system and method for performing an on-line ATM/POS transaction 
utilizing checking or savings account funds over a public access 

network 

is disclosed. The invention comprises creating an electronic financial 

transaction instruction comprising card information and security 

information that are encrypted for secure transmission over the public 

access network. The card information identifies a 

checking or savings account niamber of a 
purchaser. The security information identifies a 
personal identification number associated 

with the identified account number that 

authorizes the use of the account number in an 

on-line ATM/POS transaction. The financial transaction instruction is 
decrypted by a financial institution and reformatted 

to form a transaction request suitable for transmission over an on-line 
ATM/POS transaction system. The transaction request is then processed 
like a typical ATM or merchant POS on-line ATM/POS 
transaction. As such, approval and settlement of the financial 
transaction instruction is obtained in real time. Thus, the present 
invention provides an on-line ATM/POS transaction capability utilizing 
checking or savings account funds from a public access network, such as 
the Internet or electronic mail. 
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A system and method for the collection of marketing data simultaneously 
captures at a point-of-sale all financial and non-financial data 
pertaining to a specific consumer transaction. An electronic invoice is 
constructed from the captured data and transmitted to a credit 
authorization location via a communication link necessarily established 
to transmit a credit authorization request for the transaction. The 
electronic invoice contains line item data for each 
item purchased as part of the transaction. The invoice 

is organized around the identification number of the payment vehicle 
employed by the customer to pay for the transaction, thus linking the 
purchasing information contained in the invoice to a particular 
consumer. The credit authorization location receives the transmitted 
electronic invoice and forwards the invoice to a data warehouse, which 
may be located in a location remote from the credit authorization 
location. The data warehouse comprises a plurality of related data 
structures for storing the received data. The related data structures 
facilitate simple and flexible analysis and searching of the collected 
market data. 
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AB A method for enabling users over a network or over the WWW to interact 
with an interactive sales representative system for providing sales 
guidance. The system offers the user products, services, or ideas (the 
"products") according to parameters collected from the user. The system 
guides the customer to retrieve the desired products. If the system 

does 

not have a product matched to the customer requirements, preferably it 

will operate a mechanism for suggesting alternatives which are the 

closest to the customer requirements. The system will execute various 

sales tools and techniques to help and assist the customer and to 

convince the customer to purchase a product. By 

guiding the customer to the target product, the system will 

shorten the search cycle for the customer as well as find better 

matched 

products. The system will provide market advisory, suggest, recommend, 
discuss (in written form and optionally voice form), comment, advise 



the 



in 



customer regarding the products. The system might advise the customer 

any other aspects as well (such as providing personal feedback) . The 
system adds graphics, animation, 3D, movie clips, voice and other 
effects to make the session enjoyable for the customer. The system is 
capable of executing various tools and techniques to improve its sales 
capabilities and bring better sales results. 
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A complete system for the purchasing of goods or 
information over a computer network is presented. Merchant 
computers on the network maintain databases of digital advertisements 
that are accessed by buyer computers. In response to user 
inquiries, buyer computers retrieve and display digital 
advertisements from merchant computers. A digital 

advertisement can further include a program that is interpreted by a 
buyer *s computer. The buyer computers include a means 
for a user to purchase the product described by a 

digital advertisement. If a user has not specified a means of payment 

the time of purchase, it can be requested after a purchase transaction 
is initiated. A network payment system performs payment order 
authorization in a network with untrusted switching, transmission, and 
host components. Payment orders are backed by accounts in an external 
financial system network, and the payment system obtains account 
authorizations from this external network in real-time. Payment orders 
are' signed with authenticators that can be based on any combination of 

secret function of the payment order parameters, a single-use 
transaction identifier, or a specified network address. 
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A method of payment in an electronic payment system wherein a plurality 
of customers have accounts with an agent. A customer obtains an 
authenticated quote from a specific merchant, the quote 
including a specification of goods and a payment amount for those 
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the 



The customer sends to the agent a single communication including a 
request for payment of the payment amount to the specific 
merchant and a unique identification of the customer. The agent 

issues to the customer an authenticated payment advice based only on 

single communication and secret shared between the customer and the 

agent and status information which the agent knows about the 
merchant and/or the customer. The customer forwards a portion of 

the payment advice to the specific merchant. The specific 
merchant provides the goods to the customer in response to 

r 
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A system and method of implementing a secure purchase management system 
wherein a unique account code is assigned to a purchaser; a 
set of secret transaction codes are provided to the purchaser, 
one secret transaction code to be used for each individual purchase to 
be made by the purchaser; and each purchase request from a 
purchaser is verified to make sure it includes the 
purchaser's account code and a transaction code which has not 

been used before to thereby prevent unauthorized purchases and fraud. 
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An infrastructure for a real time bank-centric universal 
payment system in which a central processing unit (CPU) defines an 
electronic commerce trust system formed from a plurality of financial 
service provider members subscribing to a common standard having 
applicability throughout the infrastructure. The central processing 

is operatively interconnected to the correspondent processing units of 
financial service provider members that in turn are operatively 
interconnected through access mechanisms to a network of customers and 
goods and services providers who are account subscribers with the 
financial service provider member and subject to the common standard of 
the system. The CPU provides non-revocable real time debit and credit 
transactions and effects provider net settlement between and among 
members through a central exchange monetary system. Features of the 
infrastructure include an ECTS hot file, bill presentment and payment 
options and provider designed services that enhance brand identity. 
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AB A purchase transaction is performed between a client browser and a 

merchant server over a general access wide area connected 

network. The transaction appears to the client as singularly 
identifying 

a purchasable product or service and 

singularly confirming the purchase. A persistent predetermined 
coded identifier is established on the client browser corresponding to 
an account record stored by the merchant server. A 
predetermined URL referencing a purchasable product 
or service is served to the client browser. The predetermined 
URL includes an implicit reference to the persistent predetermined 



coded 



identifier. The predetermined URL is received by the merchant 
server, including the predetermined coded identifier, in response to a 
client browser selection. The merchant server validates the 
predetermined coded identifier against the account 
record and records an identifier of the purchasable 
product or service as derived from the predetermined 
URL by the merchant server. 
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A method for executing a secure online transaction between a 

vendor computer and a user computer, wherein the vendor computer and 
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user computer are interconnected to a computer network such as the 
Internet for data communications therebetween. The method 

comprises the steps of the user computer transmitting a transaction 
request message to the vendor computer via the computer network, the 
financial transaction request comprising user identification data 



unique 



data 



to the user computer; in response to receiving the transaction request, 
the vendor computer sending a transaction verification request to a 
trust server computer interconnected to the computer network, the 
transaction verification request comprising the user identification 

and data indicative of the requested transaction; in response to 
receiving the transaction verification request, the trust server 
computer authenticating the user computer by using the user 
identification data and communicating with the user computer for 
verification with the user identification data; and the trust server 
authorizing the transaction when the authenticating step has passed. 
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When performing on-line shopping using the Internet, and when 
performing payment settlement for a product by a credit 
card, user's card data runs over the Internet 

, leaving the possibility of card data leakage, thereby causing a 

security problem. The user decides the product he or she wants 

to buy via a computer network (Internet) from a user 

system. Then, a transmission unit calls up a service center to send 

order data including the credit card data via a 

settlement network. Service center invoices the sales price to an 
approval center based on the order data. Approval center pays the price 
to service center. Then, service center sends the order data to the 
shopping system. A delivery processing unit then delivers the product 

the user based on the order data. 
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A payment system for enabling a first Internet user to make a 
payment to a second internet user, typically for the 
purchase of an information product deliverable over 

the Internet. The payment system provides cardholder accounts 
for the first and second Internet users. When the second user 
sends the information product to the first user over the 
Internet, the second user also makes a request over the 
Internet to a front end portion of the payment system requesting 
payment from the first user. The front end portion of the payment 

system 

queries the first user over the Internet whether to proceed 
with payment to the second user. If the first user replies 
affirmatively, a charge to the first user is processed off the 
Internet; however if the first user replies negatively, the 

first user is not charged for the information product. The payment 
system informs the second user regarding whether the first user's 
decision and pays the second user upon collection of the charge from 



the 



first user. Security is maintained by isolating financial and credit 
information of users* cardholder accounts from the front end portion of 
the payment system and by isolating the account 
identifying information from the associated e-mail address. 
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A method and system for securely indicating to a customer one or more 
credit card numbers that a merchant 

has on file for the customer when communicating with the customer over 
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non-secure network. The merchant sends a message to the 
customer that contains only a portion of each of the credit 
card ntixnbers that are on file with the 

merchant. The message may also contain a notation explaining 

which portion of each of the credit card 
numbers has been extracted. A computer (38) retrieves the 
credit card numbers on file for the customer 

in a database (40), constructs the message, and transits the message to 

a customer location (10) over the Internet network (30) or 

other non-secure network. The customer can then confirm in a return 

message that a specific one of the credit card 
numbers on file with the merchant should be used in 

charging a transaction. Since only a portion of the credit 
card number (s) are included in any message 

transmitted, a third party cannot discover the 

customer's complete credit card number (s) . 
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A system for facilitating commercial transactions, between a plurality 
of customers and at least one supplier of items over a computer driven 
network capable of providing communications between the supplier and at 
least one customer site associated with each customer. Each site 
includes an associated display and an input device through which the 
customer can input information into the system. At least one supplier 

presented on the display for selection by the customer using the input 
device. Similarly items from a supplier can be displayed for the 
customer to observe. Associated with a supplier of such items is an 
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database including information on presented items. Pricing subsystem 
receives information from the item database to determine the cost 
associated with a presented item. In addition a customer information 
database stores information relating to the customer. Associated with 
each customer is a customer monitoring object for each customer. The 
customer monitoring object is created by referencing information, 
relating to that customer, which had been stored in the customer 
information database and when the customer selects a supplier. The 
customer monitoring object is configured to operate by responding to 
customer enquiries regarding a presented item by retrieving information 
relating to the item and presenting the information to the customer; 
receiving a customer's selection of a presented item; receiving 
customer 

communications, indicating a desire to receive the item; and passing a 
communication to initiate the delivery of the item to the customer. 
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4 Drawing Figure (s); 
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A courier electronic payment system provides customers, 
merchants, and banks with a secure mechanism for using 
a public network as a platform for credit card 

payment services. The system governs the relationship between a 
Customer, Merchant, and Acquirer Gateway to perform 
credit card purchases over such networks as the 
Internet. The system uses a secure connection to simplify the 
problem of Internet-based financial transactions in accordance 
with an electronic payment protocol that secures credit 
card payments and certifies infrastructure that is required to 

enable all of the parties to participate in the electronic commerce, 
well as to provide the necessary formats and interfaces between the 
d 
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..SPECIFICATION multiplexer cards provides for 4 network ports. 

The shelf also contains 2 pairs of common cards , a pair of cell 
clock generator cards (CELCLK) for timing, and a pair of parallel... a 
lower order shelf. The fault of this cable is detected by grounding an 
idle pin in the cable in the higher order shelf and monitoring the 
state of the pin... Figure 204. 

In Figure 204, an actual SMDS terminal unit is connected beyond the 
subscriber network interface (SNI) . Likewise, an switching system (SS) 
is connected beyond the inter-switching-system interface... 
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Claims 

Claim 

order form. The form should be easily customizable and may contain a 
variety of information. 

Order Form Standard online form with the usual questions: Name, 
Address, shipping location, credit card number, email address, etc. 
The user usually has the ability to submit or decline the ... transaction 
with a unique identifier used to track funds if necessary. 



Security. In the past, eCoimnerce has been hampered by the absence of 
secure and robust transaction options. Recent development of secure 
online payment options over the Internet have been a primary enabler. 
Strongly-encrypted online purchase transaction protocols have been 
developed and integrated into software for consumers, merchants, and 
banks to enable secure credit card transactions. 

Consumer Type. The types of flow and payment medium will vary greatly 
depending on... value stored on it at any merchant accepting smartcards. 
This technology is particularly useful for online shopping , and is 
far less vulnerable than systems storing value on a hard disk. 
Transaction costs... 

..one penny or less. Microsoft and several computer manufacturers are 
pushing for standards to incorporate smartcard readers into PC 
keyboards, and most TV set-top Internet access devices already have them 
...In a sample transaction, the customer will dial into their ISP and 
surf to the shopping mall site. The web server 12102 will then 
request a cookie from the user*s web browser to determine... 

..the payment services function at the bottom of the picture. Payment 
services will validate the credit card , and send back a positive or 
negative response. Once the payment has been approved, an an item a 
button is pressed and it is added to a virtual shopping cart 4 38 
Customer clicks on check out which transfers the customer to a secure web 
server and asks for a password or the creation of one for a first time 
shopper Secure web server authenticates user and displays order and 
credit card information Customer has the opportunity to change order, 
credit card or shipping information then accepts the order. 

Information is passed from the web server to. , . 
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Detailed Description 

... after the printing is done. 

In a specific embodiment the server 110 is a conventional e -coimnerce 
website, maintained by a service company. Consumers using user systems, 
such as I I 8a . . . 

...account is opened on the server 110, the user system, for example, I I 
8a, receives a secure password which can be used to obtain complete 
access to the e commerce site via a secure link, such as, for 
example, a Secure Sockets Layer (SSL) link. . , 

...another embodiment the consumer may be identified by his/her consumer 
e-mail address and credit card . The account allows the consumer to 
deposit funds in the account, for example by credit card , smart 
card / or bank transfer, or by cash/check through the mail. The consumer 
may then draw. . . 
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Detailed Description 

the scheme owner, for adding value to the card. This may, for example, 
be a credit card transaction as is conventionally used for purchase 
over the internet . Card value data and a card value access code is 
then received by the content access terminal from the scheme owner at 



step S 16. The card. . . 

.provides digital signature data representing value to the content access 
terminal for writing onto the smart Flash card . 

At step S 17, card registration data is received from the scheme owner by 
the. . . 
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English Abstract 

A method of and system (10) for making purchases over a computer 
network using an ATM card or the like is provided. In accordance 
with the invention, a consumer (12) transmits his ATM card number 
over the network (24) to an on-line merchant (16) . The on-line merchant 
(16) then forwards the ATM card number to a third party contractor 
(20), such as a bank, that will oversee and authorize the transaction. 
Simultaneously or thereafter, the consumer (12) transmits his PIN 
over the network to the third party contractor (20), who verifies that 
the ATM card number and PIN are valid. 
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English Abstract 

A secure method for purchasing goods through an electronic media such aSj 
internet using credit card number for a payment for internet trade. 
When a customer accesses to a certain shopping mall through internet 
deciding to purchase some goods ^ the computer in shopping mall 
generates customer identification number which comprises the online... 

...data which contains the information of the goods which the customer 
chose to purchase. After receiving this identification number , the 
customer accesses to the computer of credit card company through 
internet and informs his credit card number and security number. 
After confirmed credit, the customer sends the customer identification 
number to the computer of credit card company. With this customer 
identification number, the credit card company contacts the shopping 

mall through online and confirm abouts the customer *s credit and 
finally pays for the goods on behalf. . . 

Detailed Description 

... which is saved in seller's host computer in specific files or in 
database . 

After receiving the purchaser's access number from the seller's 
host computer via internet , purchaser will access to the homepage of 
credit card company through internet. 

As the host computer of credit card company request to the purchaser ... b 
used as internet address for access by host computer of credit card 
company . 

After receiving the purchaser's access number from the seller's 
host computer via internet , purchaser will access to the homepage of 
internet card company. (S23) As the host computer of card company request 

to the purchaser, the purchaser will input his ,cr edit card number and 

secret number. (S24) After checking the credit of purchaser using credit 
card number and secret number, host computer of , credit card company 
send the message for starting payment procedure. (S25) The purchaser will 
provide the the purchaser's access number to the host computer of credit 

card company through internet using his computer. (S26) For example, 
he will input www. audi owo rid . com. .. several different internet shopping 
malls. The purchaser's access code is also different from each internet 
shopping mall . 

The purchaser can compare the conditions for the goods, for example, 
the price, the delivery, warranty, etc. When the purchaser has chosen th 
best conditions for the goods from the specific internet shopping 
mall, he can send the purchaser's access code from this shopping 
mall to the host computer of credit card company or host computer of 
bank . 

Also the information for the goods from the seller... 

...computer of credit card company or bank. 

ISThis purchaser's personal identification number registered in credit 
card company is related with purchaser's credit card number. So the 
purchaser can access to the host computer of credit card company with 
his identification number to follow the process the internet trade as 
described in this invention. When the host computer of credit card 



20company received the purchaser's identification number and 
following security number and with purchaser's access code, it search for 
the credit card number in database which is matched with this 
purchaser's identification number. After searching for the credit 
card number, the host computer of credit card company will continue 
the internet payment system using purchaser 's access code with 
seller's host computer. 

The advantage of using purchaser's identification... 
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Detailed Description 

One may have freely given other businesses sensitive inf ori-nation 
aboutonerself , such as one's credit card number or one's social 
security number. To what lengths must that business go to... 
identification number or PIN. password compromised The combination of the 
one- than hard token time password and the PIN, along with the user's 
public username, provides two factor authentication of... 
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Detailed Description 

. . . and banks with a secure mechanism for using an open network as a 
platform for credit card payment services. The system governs the 
relationship between a Customer, Merchant, and Acquirer to perform 
credit card purchases over open networks as the Internet. The 
basic method involves a secure connection with an encryption technique 
(SSL... 

...isolated from the Internet. The PIN code is a plain code randomly 
computer-generated. This PiN code is received automatically and 
securely at the customer's IMSI (International Mobile Subscriber 
Identity) which 



f 1(n1 arijL . 
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Claim 

real tim e., comprising the steps of: 

receiving an order request from a seller or a buyer containing an 
internet protocol address of a buyer, a seller ID; displaying a purchase 
authorization screen to the. . . 

. . .buyer and provider of the method at the internet protocol address sent 
by the seller; receiving a buyers* transaction identification number 
and personal identification number from the buyer through the purchase 
authorization screen; comparing buyers* transaction.., 

...transaction identification number generated by the internal network, and 
upon successful comparison, providing the buyers* credit card data to 
the sellers* seller account processor. 

14, The method for facilitating secure electronic commerce... 
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Detailed Description 

The client system according to the present invention can be adapted to 
interface with, the electronic commerce system of the above described 
server to facilitate the transfer of value and enable to , . . 

...system can verify the identity of the client system by requesting the 
client system to transmit a predefined message, identification code 
, or electronic certificate which is encrypted using the key embedded in 
the client system. The... 

...it to an expected value. The same message can include other information 
such as a credit card information (number and expiration date) or an 
authorization to debit an account (including an account 
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Detailed Description 

... be classified as follows: 

* Content; 

-Signaling; or 
- Data. 

Normally, a customer interacting with the intelligent network will 
require all three types of information flows. 

a) Content 

Content flows contain the primary. , . 



...channels with flow of other information, 
b) Signaling 

Signaling flows contain control information used by network elements. 

ISUP RLT/IMT, TCP/IP domain name lookups and ISDN Q.931 are all... 
Interfaces which are at the same site. 

Figure 38 shows a representation of a physical network 24 00 schematic . 

Networks 2401 contain network elements 2402 at sites 2404 are 
interconnected through network interfaces 2406 and ... subscriber will have 
the ability to establish a notification schedule, through the 
directlineMCI ARU, to receive a pager message which indicates the 
number of voicemail, faxmail, email and pager messages that... but such 
integration can be implemented in an alternative embodiment. The 
subscriber is able to send a message to a distribution list from the PC 
Client, lads requires a two-way. . .a special area code. Coher direct 
billing options axe 900 calls and calling card (or credit card ) 
billing options (both require a second dial tone) . 

Requiring all callers (except incoming PSTN calls .. .Vnet, "Remote Access 
to Vnet, Vnet Phone Home, CVNS, Vnet Card, MCI Card (950 Cards), Credit 
Card and GETS Card. In support of the existing VNET services, the DAP 
provides private dialing. . . 
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English Abstract 

...satellite radio or television system includes a decoder and means to 
accommodate a credit or bank card carrying a microprocessor, and 
means to interact with said microprocessor when the credit or bank 

card is inserted into an operative position in said receiver/decoder in 
order to enable data carried by said credit or bank card to be read 
and data to be input to the microprocessor carried by said credit or 

bank card . A PIN number may be transmitted to the receiver/decoder 
in a secure fashion by means of a remote controller, which is also 
described. Applications of the invention include Pay-Per-View television. 



teleshopping and telebanking. 
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use of the PSTN is avoided by routing the call from the PC to the 
Internet / Intranet to an internet gateway directly connected to a PBX. 

Figure 14 illustrates a VNET Personal ... client/ server platform that can 
receive and process events that are generated by various SS7 network 
elements. Each network event is parsed and standardized to allow for 
the processing of events generated by any ... network management systems 
(NMS) 338. 

Using topology data, SNMS will correlate these events with events 
received from SS7 network elements. The SNMS Alarming Server 302 also 
receives network maintenance schedule information ... topology data that 
has been entered into order entry and engineering systems and stored in 
Network Topology Databases 334. It also accepts manual overrides 336 via 
workstation. The collection of data...SS7 linkage of an STP 104 with a 
Switch/ SSP 102, data is received by network order entry and 
engineering systems. The data and a brief description of its contents is 
provided. . . 
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to carry different contents on different networks, each of which is 
specialized for specific content transmission . 

Both technology and customer requirements (for on-demand high bandwidth) 
will require carriers to use.,,Vnet, Remote Access to Vnet, Vnet Phone 
Home, CVNS, Vnet Card, MCI Card (950 Cards), Credit Card and GETS 
Card. 

In support of the existing VNET services, the DAP provides private 
dialing. . . 
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customer to fill out an application form providing standard personal 
information. First Virtual would then send a personal identification 
nxiihber (PIN) with an 800 number over the Internet to the customer's 

email. Then the customer is supposed to use the 800 number to give his 
credit card information over the phone to First Virtual to establish 
or open no more than just an electronic charge account. Clearly this 
system or procedure to shop on the Internet is no less complicated 
than the home shopping network and is nowhere close to a simple and 



anonymous cash dispensing system that one would. 
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.SPECIFICATION chart to show the case that the user 31 had a reservation 
by using an IC card - When the user 31A inserts his IC card into 
the card insertion port 18, the card reader 42 leads the ic card 
therein to read the identification nvuriber recorded in the ic card 

(51) and transmits the identification number to the CPU 39. The CPU 
39 refers to the data memory 41 based on the identification number 

(52) to judge whether a corresponding reservation data is therein (S3) . 
At the same time, the monitor camera 36 makes a confirmation of the 
user 31A himself. 

If there is no corresponding reservation data (S3: No), the... 
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...SPECIFICATION 7. In the center 1, a receiving data confirming circuit 48 
confirms and checks the transmitted reward ID code and electronic 
purse specific information. The receiving data confirming circuit 48 
checks the correspondence of data stored in the reward data memory 58 to 
the transmitted reward ID code and instructs an electronic purse 
card 63 in the center 7 to pay money data corresponding to an amount of 
reward . . . 7 . 

In the center 1, the receiving data confirming circuit 48 confirms and 
checks the transmitted reward ID code and electronic purse specific 
information. The receiving data confirming circuit 48 checks the 
correspondence of data stored in the reward data memory 58 to the 
transmitted reward ID code and instructs an electronic purse card 
63 in the center 7 to pay money data corresponding to an amount of 
reward. , . 
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only knows the card number (or a portion of it) . The trusted 



verification system separately receives the pin number from the 
customer and processes the transaction with the credit/debit processing 
system. The functionality performed by the trusted verification system 
may be performed by the debit card organization/bank directly. 

DISCLOSURE OF THE INVENTION 

The present invention, in summary form, allows a... 
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... f by the credit card company. 

3 An example of the ease of use of credit cards can be found in 4 the 
"pay at the pump" type systems utilized at gas associated with the full 
electronic transact :Lon 7 that occurs by swiping the credit card 
through a magnetic card 8 reader and waiting only for validation of the 
account ove2f. a 9 telecommunications data line. The ability of credit 
cards to be 10 used by those who are unauthorized for such use is built 
into t-he 11 credit cards themselves because of their "active" 
conditi(Dn, 12 Almost all credit cards are "active" and respond when 
swi-ped 13 through a reader by merely transmitting an account number to 
t--he 14 reader for validation . Once the account number has been 
confir-med 15 to be valid by access and reference to a central credit 
card dcata 16 bank, authorization is given to carry out the financ:Lal 
17 transaction. The. . . 

...es IS in bank automatic teller machines wherein even for major credit 
19 cards or bank cards , the user is required to input a PIN 
(persorial 20 identification number ) in order to receive cash drawn 
on t — he 21 credit card account. This system is in place primarily 



because of 22 the analogous system utilized in conjunction with debit 
cards or 23 ATM cards offered by the banks. In the case of an ATM, 
howevEr, 24 the user is required to input a PiN at the point of 
transact :: Lon 25 which in combination with the account number is... 

. .data bank for comparison and authorization. In the viast 27 majority of 
financial transactions, however, credit cards aLre 28 utilized 
without such PIN requirements, which results in t : . he 29 convenient and 
frequent unauthorized use of the card. . . 
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Detailed Description 

English Abstract 

A method of and system (10) for making purchases over a computer network 
using an ATM card or the like is provided. In accordance with the 
invention, a consumer (12) transmits his ATM card number over the 
network (24) to an on-line merchant (16) . The on-line merchant (16) then 
forwards the ATM card number to a third party contractor (20), such 
as a bank, that will oversee and authorize the transaction. 
Simultaneously or thereafter, the consumer (12) transmits his PIN 
over the network to the third party contractor (20), who verifies that 
the ATM card number and PiN are valid . 
Detailed Description 

... as a bank, that will oversee and authorize the transaction. 

Simultaneously or thereafter, the consumer transmits his PIN over the 
network to the third party contractor, bypassing the on-line merchant. 
Having both the ATM card number and the pin , the third party 
contractor verifies that the ATM card number and PIN are correct, 
checks for sufficiency of funds, and either authorizes or denies the 
transaction. The... 



.is operated by or for the third party contractor. Simultaneously or 



thereafter, the first computer transmits the consumer's pin over the 
• network to the third computer, bypassing the second computer. The third 
computer then verifies that the ATM card number and pin are 
correct and that there are sufficient funds in the bank account to cover 
the transaction amount. The third computer then transmits the results of 
the verification procedure to the second computer. Depending on the 
verification results, the purchase is either completed or rejected. 

The present invention will now be described, . .block 78). 

TAs figure 4 indicates, the on-line merchant is completely bypassed and 
j never receives the pin . Fourth, the third party contractor verifies 
/the ATM card number and PIN and checks for sufficiency of funds 
A (block 80) . Fifth, the third party contractor transmits the results of 
^^y\jjN jthe verification process over the network to the on-line merchant 
/(block 82) . 

And sixth, the on... 
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Detailed Description 

... information 4 shown in Fig, lA first with the credit card issuing 
authority who will authenticate the user from personal information held 
on the database 16 and may obtain the information. . . 

...form, or over the telephone. Furthermore, it is preferable that the UGI 
graphic and the password are not sent in the same email for added 
security purposes. The embodiment above was shown with the UGI graphic 
and the password in the one email for illustrative purposes. 
It should also be realised that in another... 
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Claims 

Claim 

... a payment code window associated with the user, wherein the purchase 
information includes a merchant identification nTomber r receiving a 
transaction from a user in a server, wherein the transaction is based on 
the received purchase information and includes a payment specific 
authentication number and a cash card identification niuriber / 
processing the transaction; and transmitting an acknowledgment to a 
merchant computer of the transaction . 
74. . . 
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English Abstract 

A secure method for purchasing goods through an electronic media such as 
internet using credit card number for a payment for internet trade. 
When a customer accesses to a certain shopping mall through internet 
deciding to purchase some goods, the computer in shopping mall generates 
customer identification number which comprises the online internet 
address of this computer and location of the saved data which contains 
the information of the goods which the customer chose to purchase. After 

receiving this identification number , the customer accesses to the 
computer of credit card company through internet and informs his 

credit card number and security number. After confirmed credit, the 
customer sends the customer identification nvimber to the computer of 

credit card company. With this customer identification number , the 
credit card company contacts the shopping mall through online and 

confirm abouts the customer's credit and finally pays for the goods on 
behalf of the . . . 
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Detailed Description 

... to a single computer and therefore not versatile. Furthermore, once 

the cardholder enters a required password the information is 
transmitted to the retail site. The retail site therefore holds all the 
necessary information to make... 




...numerous proposed systems in which a password is required to verify 
information stored on a credit card - Universally, these systems 
transmit the password with the card information. The security of the 
card is lost because the information may. . . 
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Claim 

... network, comprising the steps of: 

receiving a purchase request from a buyer or a seller; receiving a 
buyers' account identification number from the buyer; receiving the 
buyers* personal identification from the buyer; generating a transaction 

identification number that is unique to this specific transaction; 

transmitting the transaction identification nxamber to the buyer; 
buyer authorizing the purchase by transmitting the transaction 

identification nvimber to the seller; seller processing the transaction 
by sending the transaction identification nxiihber to the seller's 

credit /debit card processor for routing through the normal approval 
network for credit, or debit , card transactions, and transmitting the 
buyers* credit card data to a Provider-authorized processor operating 
within the normal credit card authorization network upon 

verification that the received transaction identification number 
matches the unique transaction identification number generated for 



this transaction. 

2. The method for facilitating secure electronic cornmerce as in claim... 
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Detailed Description 

system can verify the identity of the client system by requesting the 
client system to transmit a predefined message, identification code 
, or electronic certificate which is encrypted using the key embedded in 
the client system. The, , . 

...it to an expected value. The same message can include other information 
such as a credit card information (number and expiration date) or an 
authorization to debit an account (including an account number) . 
Alternatively, other known identification verification methods can be 
used to verify the client system. 

In another embodiment, a public key encryption system can be used to. . . 
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Detailed Description 

... links. In this embodiment, payment processor 16 maintains data that 
provides a correlation between customer/ transmitter ID numbers and 
payment methods. Also, merchant store 12 creates a transaction record 
based using the customer/ transmitter ID number instead of the 
credit /debit card number. In operation, when an authorization 
request is transmitted to transaction processing system ...from a 
merchant store 12, transaction processing system 26 processes 
transactions by matching the customer/transmitter ID n\amber with 
data stored in customer information database 100. After the system 
identifies the customer ID. . . 

...the payment processor 16. That is, at the same time as the rest of the 
authentication process is occurring, the system may authorize the 
initiation of delivery of the desired goods... 
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Detailed Description 

■ . , 10 inputs the PIN to agent terminal 402, and, in step 816, agent 
terminal 402 transmits the card number, pin , and transaction code 
(i.e., "close") to PDC 404. In step 818, PDC 404 checks... 



...to agent terminal 402. Once approval is received, in step 822, agent 104 
gives the money to card user 10, minus any transaction fees. If 
approval is not given, the transaction is denied. .. 982 , card user 10 
inputs the PIN and the desired reload amount, and the agent transmits 
the card number, PIN , and reload amount to the PDC. The PDC accesses 
the TELCO, the TELCO checks its card file to verify that the PiN 
matches and that all other required criteria have been met, adds the 
reloaded value to. . . 
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English Abstract 

A loyalty file structure for a smart card (104) includes any number 
of loyalty files (106-112) preinstalled by a card manufacturer. Each 
loyalty file (300) has a password (302), a file number (304), a label 
(306), an indicator of whether or not the... 

...data format indicator (312), and a data region (314). An issuer (102) 
creates a unique password for each loyalty file on a card and then 
issues cards to customers (514) . For, . . 



.of-sale, a merchant determines if a loyalty file is available (FIG. 8A) 



The merchant password is sent to the issuer on-line in real time 
(FIG. 8B) and is returned along with authorization from the issuer to 

replace the password of the loyalty file with the merchant password 
(FIG. 8C) . The file label (306) is changed to a merchant identifier and 

the file. . . 

. . .with the same information downloaded from the airline host computer 
(910) . A match indicates a valid purchase and a boarding pass is 
issued. 
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Detailed Description 

... account. Initialized electronic checkbooks may be sent to the account 
holder, in which case the PiN should be sent separately for security 
reasons. Alternatively, uninitialized cards may be distributed to bank 
branches. The bank officer can then use a trusted initialization terminal 
and a special smart card identifying the bank officer to establish a 
secure connection to a centralized CIS. The new... 

...customers, accounts can be added to electronic checkbooks already being 
used by the customer, and certificates can be refreshed prior to their 
expiration dates without issuing new electronic checkbooks. The bank, or 
its agent, is also acting as a certifying authority since it is 
responsible for authenticating the identity of the electronic checkbook 



^ and PIN are delivered to the correct person. The electronic check may 
also support correspondent banking relationships... 
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Detailed Description 

Detailed Description 

... account. Initialized electronic checkbooks may be sent to the account 
holder, in which case the PIN should be sent separately for security 
reasons. Alternatively, uninitialized cards may be distributed to bank 
branches. The bank officer can then use a trusted initialization terminal 
and a special smart card identifying the bank officer to established 
a secure connection to a centralized CIS. The new... 

...customers, accounts can be added to electronic checkbooks already being 
used by the customer, and certificates can be refreshed prior to their 
expiration dates without issuing new electronic checkbooks. The bank, or 
its agent, is also acting as a certifying authority since it is 
responsible for authenticating the identity of the electronic checkbook 
holder and for ensuring that the electronic checkbook and PiN are 
delivered to the correct person. The electronic check may also support 
correspondent banking relationships 
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ABSTRACT 

. . . from a telephone 20, and a referring means 12 which receives the signal 
of the identification number and password of the cash card from 
the voice responding device 11, and verifies the validity of the cash 
card by collating this signal with the recorded contents of... 
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ABSTRACT 

PROBLEM TO BE SOLVED: To allow an IC card side to receive and certify 
password information provided for an IC card user without increasing 
the burden such as the user's memory and safely against tapping action. 



SOLUTION: Both of a password information receiving program and a password 
information certifying program are held in the ic card as a pair. At 

the time of certifying the user of the IC card , the password 
information receiving program is loaded from the ic card 12 to a 

terminal device 13, which transmits/receives information between the IC 

card 12 . . . 

...password information inputted through this display picture for inputting 
password information is transferred to the password information 
certifying program operating in the IC card 12 from the password 
information receiving program to certify the propriety of user password 
information . 
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ABSTRACT 

...non-used sum in case of losing the IC card. 

SOLUTION: In this method for confirming transaction information, when 
loading a sum in an IC card / an ID niaihber is assigned to a 

withdrawn sum from a bank account, and added to a transaction. . , 
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ABSTRACT 

PROBLEM TO BE SOLVED: To authenticate password information, which only 
an IC card user has, safely against a tapping action without increasing 
the burden on user*s memory or the liJce by holding a pair of a password 
information acceptance program and a password 
authentication program in an ic card for every service. 



information 



SOLUTION: When a bank A as a service provider 11 provides the... 

...has an account in this bank, the bank A preliminarily delivers a pair of 



the password information acceptance program and the password 
'information authentication program to the ic card 12. When the ic 
card 12 is inserted to a slot of a terminal equipment 13, the password 
information acceptance... 

... the IC card 12, and execution in the terminal equipment 13 is started. 
Simultaneously, the password information authentication program is 
started on the IC card 12 and exchanges data with the password 

information acceptance program loaded in the terminal equipment 13 by 
communications . 
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Abstract (Basic) : 

The IC card reader (4) reads ID nximber and stamp seal 
data of old ic card certificate (C) . Based on the read ID 
niamber and stamp seal classification code, in individual data table, 
and stamp seal data correspondence table... 
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Password authentication system for authenticating user accessing toll 
web page, releases password only if individual credit card nxamber 
and dummy password are in accord 
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Abstract (Basic) : 

... following multiple checkpoints. Before a user can access the 

personal Web pages contained on a Smart card , the user is 
validated by means of a personal identification number , facial 
image, eye image, hand image, fingerprints, and/or voice 
characteristics. Also, further verification is... 
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Abstract (Basic) : 

memory with validation signal. A card dispenser (20) is 
connected to teller machine for dispensing debit card with unique 
identification number after predetermined number of conditions is 



satisfied and validation signal is received from teller machine. A 
computerized cleaning house (60) is remotely located with... 
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Abstract (Basic) : 

... transaction is inserted into electronic wallet (1) and transfer 

of money from personal account of ic card user is performed. A 
password input switch (4) or finger print authentication device (5) 
provided in the electronic wallet is used for user authentication. The 
electronic wallet... 
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. . . voting procedure involves tabulating voting results obtained from 
encrypted ballot papers issued by voters after verification of personal 
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Abstract (Basic) : 

authentication server (225) electronically communicates 
encrypted ballot papers (235) to the voters (205-211) after verifying 
voter identification nvimbers present in their smart cards 
(213-219) . The completed encrypted ballot papers are electronically 
communicated to authentication servers. The output... 
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Internet has client terminal which is connected to server terminal via 
encryption device only when valid identification number is input by 
user, while inserting smart card 

Abstract (Basic) : 

... database server. Client terminal has device for encrypting 

received encrypted law enforcement data, only when valid 
identification number is input, while inserting smart card - 

Since only when valid identification nxuhber is entered 
into the smart card reader, the user is connected to server via 
Internet, information security is ensured. . . 
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...Abstract (Basic): information managed in a tollgate center (11) by a 
path side apparatus. DETAILED DESCRIPTION - The confirmation unit 
confirms the service condition of the ic card , to which state 
information and ID number that shows service condition are 
recorded, after comparing the state information. An updating unit 
respectively. . . 
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circuit only when ID code recorded in recording medium is in accord 
with ID code of IC card 



.Abstract (Basic) : NOVELTY - If ID code recorded in a medium and 



authentication information of an inserted ic card are in accord, 
then authentication information is transmitted to a server (1) through 
a communication. . , 
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. . -Abstract (Basic) : the smart card by inputting a load command via the 
keypad (8) after requesting a PiN code which is verified by the 
smart card and the amount to be loaded. . . 
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. . .Abstract (Basic) : The method involves transmitting card public key, card 
identification number and master digital signature to ic card 
terminal, the terminal verifies the signature and if it is valid, 
transmits the terminal public key, the terminal identification... 

. . .Abstract (Equivalent) : said IC card terminal to create a digital 
signature, a terminal public key nT for verifying said digital 
signature created by said IC card terminal, a terminal 
identification number IDT and a second master digital signature SA2 
created by use of said master keys... 

...enabling said IC card to create a digital signature, a card public key 
nU for verifying said digital signature created by said ic card , 
a card identification number IDU, a first master digital signature 
SAl created by use of said master keys pA. . . 

...International Patent Class (Additional): G06F-017/60 
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ORDER MARKETING SYSTEM UTILIZING INTERNET 



ABSTRACT 

PROBLEM TO BE SOLVED: To obtain an order marketing system which does not 
use a credit card , does not need to register to an authentication 

institution in advance and is also relatively safe by preparing a 
password which corresponds to data and is valid only to product 
purchase of one time based on the customer data and the product data. 

SOLUTION: A computer 14 produces a password P corresponding to an order 

of a customer (a) by using order data in a password producing part 24. 

And, the produced password P (AIUEO (Japanese alphabet)), transfer 
payment and a payment transfer account are transmitted to the... 



... to the designated account in a financial institution B. In such a case, 
the received password P is described in the transfer name of a transfer 
form. A money receiving managing part 28 confinas money receiving based 
on the transfer amount and the password P. When a proper amount is 
received, the computer 14 instructs a shipment managing part 30 to send a 
product corresponding to the password • 
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ELECTRONIC SETTLEMENT METHOD BY ELECTRONIC MAILE WITHOUT CREDIT 
NUMBER 



CARD 



ABSTRACT 

...TO BE SOLVED: To make an electric settlement possible by an electronic 
mail witli a password available just once by an orderer and confirming 
the payment request at an electronic settlement financial means... 



. . . electronic settlement 
tlie electronic mail by 
recipient of tlie order 
means 5 the electronic 



financial means 5 with an electronic mail through 
a network 3. The orderer 1 sends at once a 
and the payment electronic settlement financial 
mail appended with a password A available just 



once which the orderer 1 freely decided, the recipient of the order. 



... a request item, send it to the payment electronic settlement financial 
means 5, leaving the password A of the electronic mail send by the order 
1 to the recipient of the order 4; the payment electronic settlement 
financial means 5 collates the item to the password A of the electronic 
mail of direct payment request from the orderer 1 to the payment electronic 
settlement financial means 5, confirms that it is the payment request by 
the orderer 1 and then the payment is... 
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ONLINE SHOPPING SYSTEM USING CREDIT CARD 



ABSTRACT 

...host system 5 of the store together with a card name, a card number, a 
password number, a payment method, etc., and the system 6 of the store 
inquires of a. . . 

...The credit company is provided with a means with which a card owner sets 
an authentication number which cannot be used after being used once, and 
the user uses this authentication number instead of the password number 
to order goods (service) . 
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user computer and merchant computer using payment card associated with 
user computer by comparing expected verification data string with 
confirmation verification data string 

Abstract (Basic) : 

... In operation a merchant computer (MC) (20) uses a transaction 

identifier in a verification approval message to retrieve an expected 
verification data string previously stored. The MC compares the 
expected verification data string with the confirmation 
verification data string from the verification approval message from 
a verification system (30) . The MC indicates that the transaction has 
been approved if the comparison is... 

... a) a verification computer for approving on-line transaction 

between user computer and a merchant computer, . . 

. . .merchant computer for executing on-line transaction with a user computer 
on approval by a verification computer. . . 

...In systems that allow debit cards , credit cards , direct 

check/ACH and other financial transaction instruments to be used in 
networked purchasing environments between a merchant, customer, and 
a third party processor acting as an intermediary or... 



.A third party trusted verification system is contacted during the 
purchase process by the merchant to request the processing of... 



...where the merchant only knows the card number (or a portion of it). The 
trusted verification system separately receives the PIN number from 
the customer and processes the transaction with the credit/debit 
processing system. The functionality performed by the trusted 
verification system may be performed by the debit card 
organization/bank directly. . . 

. . .verification system (30 
...Title Terms: VERIFICATION ; 
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Secure data entry and visual authentication system for secure input and 
communication of data including passwords to network computer systems 
or automated teller machines 

Abstract (Basic) : 

... 930) together with the web page and a user (908) selects icons 

corresponding to his credit card number to enter the card number 
using an input device (912) . The credit card data are checked 
against that held in a memory (924) to confirm the information. 

are included for server, client and communication subsystems and 
for methods of entering data and password information into a secure 
data entry system. . . 

. . . Secure entry of data and password information into a computer based 
system. . . 

...The drawing is a block diagram of an on -line shopping application 
...Title Terms: AUTHENTICITY ; 
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Event driven dynamic digital authentication for application to Internet 
financial transactions, using event driven dynamic digital 

authentication card 

Abstract (Basic) : 

Low risk financial transaction protocols for Internet and 
routine financial trading involve using an authentication method that 
uses an event driven dynamic digital authentication card. 

... By checking the PiN in an authentication server's database, 

the server can determine if a customer is a true card holder... 

...and the vendor's account stored in the server's database. The use of 
dynamic PiN authentication can be used in routine financial 
transactions e.g. direct payment using a bank card or credit 
card payment in daily shopping to prevent card fraud. . . 

...Provides event driven dynamic authentication and applications to 

Internet financial transactions, software installation authentication 
, routine credit card /bank card user authentication and 
remote access control... 

...The drawing illustrates Cyber Shopping Protocol... 
...Title Terms: AUTHENTICITY ; 



15/3, K/7 (Item 4 from file: 350) 

DIALOG (R) File 350:Derwent WPIX 

(c) 2001 Derwent Info Ltd. All rts. reserv. 

013576588 **Image available** 

WPI Acc No: 2001-060795/200107 

XRPX Acc No: NOl-045582 
Anonymous transaction authentication in internet, involves retrieving 
data related to minor customer using the duplicated information received 
from customer to authorize transaction 

Patent Assignee: BARTON P R (BART- I) 

Inventor: BARTON P R 

Number of Countries: 091 Number of Patents: 002 
Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 

WO 200063855 Al 20001026 WO 2000US10678 A 20000419 200107 B 

AU 200044763 A 20001102 AU 200044763 A 20000419 200107 

Priority Applications (No Type Date) : US 99474378 A 19991229; US 99294270 A 
19990419; US 99323437 A 19990601; US 99326298 A 19990604; US 99165546 A 
19991115; US 99165547 A 19991115; US 99474110 A 19991229 

Patent Details : 

Patent No Kind Lan Pg Main IPC Filing Notes 

WO 200063855 Al E 109 G07F-007/08 

Designated States (National) : AE AG AL AM AT AU AZ BA BB BG BR BY CA CH 
CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE 
KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX NO NZ PL PT RO RU 
SD SE SG SI SK SL TJ TM TR TT TZ UA UG UZ VN YU ZA ZW 



Designated States (Regional) : AT BE CH CY DE DK EA ES FI FR GB GH GM GR 
IE IT KE LS LU MC MW NL OA PT SD SE SL SZ TZ UG ZW 
AU 200044763 A G07F-007/08 Based on patent WO 200063855 

Anonymous transaction authentication in internet, involves retrieving 
data related to minor customer using the duplicated information received 
from. . . 

Abstract (Basic) : 

Information including transaction date, amount, time and PiN 

of a service provider (21) and duplicated identification information of 

the minor customer are forwarded. . . 
... a) anonymous transaction authentication system... 

,..b) anonymous transaction authentication server system... 

,..d) anonymous transaction card ; 
{... 

...For secured anonymous e -commerce through internet using credit / 

debit cards , gift card especially for purchase by minor customer... 

...Facilitates centralized offline customer identity and information 
authentication while maintaining anonymity of customer which allows 
service provider to easily and inexpensively authenticate customer 
related business information revealing without true identity of the 
customer. . . 

...The figure shows schematic view of the information flow model in 

authentication system 
...Title Terms: AUTHENTICITY ; 
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User compliant compact personal key for use with portable computers for 



e- commerce, actuates user input device which is coupled to processor, 
by bus which is distinct from. . . 

Abstract (Basic) : 

use with laptop, notebook computers to provide security to 
user's sensitive information such as credit card number, 
fingerprint data used for e -commerce in Internet, securing e-mail 
in business transaction and also used in virtual private network... 

...risk of intercepted communication, as personal key is used. Allows user 
to store and retrieve passwords and digital certificates without 
requiring the use of vulnerable external interfaces... 



15/3, K/9 (Item 6 from file: 350) 

DIALOG (R) File 350:Derwent WPIX 

(c) 2001 Derwent Info Ltd. All rts . reserv. 

013084160 **Image available** 

WPI Acc No: 2000-256032/200022 

XRPX Acc No: NOO-190361 
Initialization, configuration and resource management system for 
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Patent Assignee: MICROSOFT CORP (MICR-N) 

Inventor: BARLOW D; DILLAWAY B; FOX B; LIPSCOMB T; SPIES T 
Number of Countries: 001 Number of Patents: 001 
Patent Family: 
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Initialization, configuration and resource management system for 
multipurpose integrated circuit card using personal computer 

Abstract (Basic) : 

... a computer-implemented application and to facilitate user access 

to certain resources provided by an IC card . 

The multipurpose IC card has several resources for different 
uses. A card reader interfaces with the ic card to transfer 
information to and from the ic card . A computer is coupled to the 
card reader to implement one application and to enable a user to access 
and manage select resources from the IC card . INDEPENDENT CLAIMS 
are also included for the following... 

...b) the computer used in configuration and resource management of ic 
card ; 

(... 

...c) the configuration system of the ic card ; 
(... 

. . .d) the IC card ; 
{... 

...For initializing, configuring and managing various resources of 

multipurpose IC card e.g. smart card , PC card, used in e.g. 
banking, electronic coimnerce , travel transaction, entertainment. . . 

...Secures management and transportation of cryptographic-related 

resources, e.g. keys, certificates , from one location to another. 
Provides uniform platform for conducting electronic transactions in 
different environments. Ensures use of ic card in encryption, 
decryption and authentication . Provides consistent presentation and 



method for managing ic card resources which are independent from 
the applications being supported. Allows examination of resources of 
IC card using icon representations of resources. Ensures that user 
can configure his or her ic card by adding and removing resources 
simply by manipulating the graphical icons. Also enables user to 
initialize ic card and change passcode in accessing ic card . 



15/3, K/10 (Item 7 from file: 350) 

DIALOG (R) File 350:Derwent WPIX 

(c) 2001 Derwent Info Ltd. All rts. reserv. 

012804547 **Image available** 
WPI Acc No: 1999-610777/199952 
XRPX Acc No: N99-450067 

Electronic commerce transaction using telephone card, WWW for 
business transaction 
Patent Assignee: TELCORDIA TECHNOLOGIES INC (TELC-N) 
Inventor: COCHINWALA M; COHEN E S; SURI N 
Number of Countries: 085 Number of Patents: 003 
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Priority Applications (No Type Date) : US 9879156 A 19980324 
Patent Details: 
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Electronic commerce transaction using telephone card, WWW for 
business transaction 

Abstract (Basic) : 

customer (101) connects with merchant (105) through telephone 
network (111) for negotiation. Customer then forwards PIN to service 
provider and merchant transmits purchase item invoice to customer. 
Invoice is sent to server (115) for validating customer approval. 
Customer approves invoice after which server allows transaction. 

Customer identification involves dealing a PIN code to service 
provider which validates customer based on the number. The customer 
approves an invoice from merchant signing the invoice. . . 

. . .by creating digital signature using e-card application running in 
customer terminal based on a password , appends it to invoice and 
transmits it to merchant. The merchant further transmits invoice to 
server which validates the signature. . . 

...For electronic coinmerce transaction like home shopping, movies on 

demand, video game, video library, home banking, music on demand using 
telephone card, WWW home shopping network . 



CA CH CN 
KP KR KZ 
SG SI SK 

GH GM GR 



.customer is not significant as he can purchase prepaid cards having 



different availability of digital money . Telephone cards have more 
security. Money collection expense is reduced. Small payments can be 
handled. Telephone company. . . 

...The figure shows block diagram of the electronic coinmerce system 
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Providing communication terminal device with networking access control 
features, particularly with Internet authentication and on- line 
shopping features 

Abstract (Basic) : 

... 5) into a reading/writing device (3), the user is prompted to 

enter a personal identification number and is logged in on a 
terminal device (1) after verification . The required data are entered 
by means of a virtual keyboard on a display (4... 

... perform a transfer, a third card (7) is inserted, which is 

accepted only if the identification number of the card is found in 
the communication terminal device database An INDEPENDENT CLAIM is... 



...Connecting a terminal device with Internet authentication and/or on - 
line shoppi ng . 



. . .Credit card (7 

...Title Terms: AUTHENTICITY ; 
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US 5887065 A 19990323 US 96620162 A 19960322 199920 B 
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Patent Details: 
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US 5887065 A 25 H04K-001/00 CIP of application US 96620162 

CIP of patent US 5737421 
Authentication system for computer network offering TV shopping, 
home banking, interactive TV games 

Abstract (Basic) : 

... A card unit (2) has a calculator to produce a password as 

function of predefined variable, which is transmitted to a central unit 
(3) . The central unit generates a variable in response to 
authentication request by the card unit, based on which another 
password is generated. The authentication function is delivered if 
both the passwords are in accord in which n digits having least 
significant weight are replaced by n. . . 

...For computer network offering TV shopping , home banking, interactive 
TV games and confidential fax messages... 

...Eliminates need for smart card or smart card reader since all 
the functions are performed by PC. . . 

...The figure shows general diagram of authentication system... 
Title Terms: AUTHENTICITY ; 



15/3, K/13 (Item 10 from file: 350) 

DIALOG (R) File 350:Derwent WPIX 

(c) 2001 Derwent Info Ltd. All rts. reserv. 

012389292 **Image available** 

WPI Acc No: 1999-195399/199917 

XRPX Acc No: N99-143669 

Credit card utilization for electronic transactions through computer 
networks like internet - assigns and utilizes ID number corresponding 
to primary identification information such as card nuzhber for 
transactions 

Patent Assignee: NIPPON SHINPAN KK (NISH-N) 

Number of Countries: 001 Number of Patents: 001 

Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 

JP 11039401 A 19990212 JP 97205464 A 19970716 199917 B 

Priority Applications (No Type Date) : JP 97205464 A 19970716 
Patent Details: 
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Credit card utilization for electronic transactions through computer 
networks like internet. . . 

...assigns and utilizes ID number corresponding to primary 
identification information such as card number for transactions 

...Abstract (Basic): NOVELTY - Card number and the corresponding ID 
number are stored in a memory. The ID niamber and another ID 
information input to a processor are communicated to another processor 
through communication circuit. Card is validated by comparing all 
identification information. DETAILED DESCRIPTION - An ID information, 
such as ID number , different from the primary ID information, such 
as card number, is used for performing transactions... 



...USE - For electronic commerce through computer networks, such as 
internet . . . 

. . . AD\AANTAGE - Enables safe and reliable transactions by preventing misuse 
of credit card by unauthorized persons... 
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Patent Assignee: HUGHES T S (HUGH-I) 
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Number of Countries: 001 Number of Patents: 001 
Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 

US 5809143 A 19980915 US 95571016 A 19951212 199844 B 

US 97896316 A 19970628 

Priority Applications (No Type Date) : US 97896316 A 19970628; US 95571016 A 
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Patent Details : 
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US 5809143 A 36 H04K-001/00 CIP of application US 95571016 

uses PIN number access to authorisation from bank for verification 
of transaction between request issuer and merchant host 

. . .Abstract (Basic) : The method for transacting a purchase using the 

internet utilises a users computer [12] with a secure QWERTY keyboard 
[30] and internet access facilities [44,48], The secure keyboard 
incorporates a magnetic card reader [34] and smart card reader [36] 
for user purchases. The controller accesses and browses the internet 
and on retrieving. . . 

...The user PIN number is input and is encrypted [40] and communicated to 
the users bank for purchase... 

...users payment details are sent and the relevant amount debited from 
their account or the smart card . The secure keyboard receives an 
acknowledgement and a purchase transaction receipt is printed at the. . . 

. . .USE - Internet shopping . 



. . .ADVANTAGE - Provides a secure facility for internet shopping / 

removing the associated risks with personal detail communication and 
also provides the user with acknowledgement 

...Title Terms: PiN ; 
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Patent Assignee: YU CARD KK (YUCA-N) 

Number of Countries: 001 Number of Patents: 001 

Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 

JP 10162067 A 19980619 JP 96317828 A 19961128 199835 B 

Priority Applications (No Type Date) : JP 96317828 A 19961128 
Patent Details: 
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involves coding user registration ID with two passwords which all 
maintained for every user to settle accounts 

. . .Abstract (Basic) : a server through the network. The client terminal 

registration information is encoded with the first password , for the 
verification . 



. ,,The encode information is again coded with the second password , and is 
stored in user's file. When the on -line shopping request signal 
is received, the registered user is checked by the referring the user's 



, . .ADVANTAGE - Enables data security for every registered user. Prevents 

invalid use of credit card by third person 
...Title Terms: PASSWORD ; 
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Patent Assignee: AT & T CORP (AMTT ) 

Inventor: MERKLER D R; REEDER K R 

Number of Countries: 001 Number of Patents: 001 

Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 
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Patent No Kind Lan Pg Main IPC Filing Notes 
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storing customer credit or debit card and account information at 
two-way TV server for transmission to credit company or ATM network 
when purchase requested 

...Abstract (Basic): customer is prompted to choose a payment method, e.g. 
by selecting from debit and credit cards . Individual data, pref . 
including details of the customer's bank account, credit card 
account, etc. and PiNs are previously stored at the server, e.g. when 
the customer is first connected. . . 

...after balance checking, and a credit is sent to the merchant's bank 
account. For credit card payment, the credit card network is 



used in a similar way, the network gateway bank again being employed. . . 

. , .when purchase made, or for dedicated hardware at customer premises. No 
need for merchant to verify approval since already done through 
appropriate network. . . 
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00122162 DOCUMENT TYPE: Review 

PRODUCT NAMES: Extranets (837385); Digital Certificates (840271) 

TITLE: The Security Behind Secure Extranets 

AUTHOR: Paget, Paul 

SOURCE: Enterprise Systems Journal, vl4 nl2 p74(4) Dec 1999 

ISSN: 1053-6566 

HOMEPAGE: http : //www . es j . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20000430 

...processes that fill in the gaps in the extranet configuration itself. 
For instance, a digital certificate , which can be called a * passport to 
the extranet, * is installed in the browser or on a smart card , where it 

authenticates the certificate holder. The digital certificate extends 
extranet access and authority to users based on their positions and their 
need to know; the certificate also maintains and ensures confidentiality 
and integrity of the data that is sent, received, and. . . 

...are also more easily and effectively managed than those that simply use 
personal information numbers (PINs ) and passwords . Secure extranets 
allow users to log on once to access authorized information, since the 
certificate and its foundational policies determine who logs on to what. 
The configuration can be changed. . . 

. . .Network managers always know who is conducting business and what they 
are doing because digital certificates track users' activity through a 
digital audit trail. Public key infrastructure (PKI), which is based... 

...receiver with a private key. Other superior security methods for 
extranets described are trusted parties (certification authorities) and 
registration authorities. 

1999 
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00122005 DOCUMENT TYPE: Review 

PRODUCT NAMES: ClearTrust SecureControl 3.5 (725358) 

TITLE: Securant Streamlines Safety With SecureControl 

AUTHOR: McEachern, Christina 

SOURCE: Wall Street & Technology, vl7 nl2 p72(l) Dec 1999 
ISSN: 1060-989X 

HOMEPAGE: http : //www. wallstreetandtech . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20000925 

...access to applications on Web sites. Software is coded to interoperate 
with and use various authentication technologies, including user names 



* and passwords , digital certificates , smart cards , and token cards. 
1999 
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00121151 DOCUMENT TYPE: Review 
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TITLE: Online Shopping: How Will Consumers Pay? 

AUTHOR; Giesen, Lauri 

SOURCE: Financial Service ONLINE, v4 n9 p38(7) Oct 1999 
ISSN: 1093-1244 

HOMEPAGE: http: //www. f inancialserviceonline . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20000228 

...is increasing at a record pace, and payment providers are testing new 
ways, other than credit cards , for customers to pay for their 
purchases. One method that is being tested is the... 

...a purchase from a participating merchant, clicking on the wallet icon 
and typing in the password automatically enters the customer's 
information into the merchant's order form. There is also renewed interest 
in the use of digital certificates that increase the security of online 
credit card payments. Another option that is being explored is the 
electronic check which is being tested. . . 

1999 
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TITLE: Creating a Password for Life from the Tip of a Finger 

AUTHOR: McKendrick, Joseph 

SOURCE: ent, v4 nl9 p22(l) Nov 3, 1999 
ISSN: 1085-2395 

HOMEPAGE : http : //www. entmag . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20000228 

...environments. Biometric security, because it is a much more powerful and 
more convenient method than passwords for authenticating an individual, 
will become a preferred security method. FIT gives administrators 
management tools for deploying... 

. . .digitized template can be stored in memory either in a standalone 
biometric device or a smart card . To gain access or authorization, the 
user identifies himself or herself with a piN or coded information card 
and puts his or her finger on the platen of the... 



...software supporting the reader, BioLogon 2.0, is also usable with other 
security devices, including smart card devices. 
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TITLE: VicinID 2.0 tightens PC security 
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ISSN: 0199-6649 

HOMEPAGE : http : //www. inf oworld . com 

RECORD TYPE: Review 
REVIEW TYPE: Review 
GRADE : B 

REVISION DATE: 19991230 

First Access' First Access VicinID Enterprise Suite 2.0, a proximity-based 
authentication system, gets good marks overall, especially for easy 
installation and automated workstation locking. However, per... 

...First Access VicinID Enterprise 2.0 currently does not integrate with 
non-Windows NT enterprise authentication tools. First Access VicinID 
Enterprise 2.0 uses a tamper-resistant battery-powered badge the size of a 
credit card to allow users to log on and off a computer just by walking 
in or . . . 

...a good choice for Windows NT shops that need more extensive security 
than user ID/password mechanisms alone. Two-factor authentication is 
provided, and users who are not at their desks all day will find First... 
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TITLE: Single Point Security 
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SOURCE: SC Infosecurity News Magazine, vlO n6 p30(l) Jun 1999 
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HOMEPAGE: http: //www, infosecnews . com 

RECORD TYPE: Review 
REVIEW TYPE: Review 
GRADE: A 
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...enterprise. UNISYS is able to accommodate these factors by allowing, for 
example, the use of smart card authentication and user ID and 
password . It also allows new users created for a system in one domain to 



be given. 
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AUTHOR: 0»Shea, Timothy 
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RECORD TYPE: Review 

REVIEW TYPE: Product Comparison 

GRADE: Product Comparison, No Rating 
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...4.0, and VASCO Data Security's VACMan/Server 3.5 are reviewed 
token-based authentication servers; V-One * s SmartGate VPN is a virtual 
private network (VPN) with token-based authentication . Tokens and token- 
authentication systems are becoming popular as an efficient and lower-cost 
way to maintain security, especially where remote access is supported. 
Strong User Authentication technology enhances security by combining 
passwords with a possession and is the basis of token-based and biometric 
authentication systems. Ace/Server gets excellent marks overall, 
especially for good integration and a large feature... 

...charts, and text files on the server. Only CryptoCard Admin 4.0 omits 
support for Smartcard tokens, while Ace/Server 3.3.1 and VACMan 3.5 
provide no support for. . . 
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TITLE: Sorting out Security 

AUTHOR: Mendel, Brett 
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RECORD TYPE: Review 
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GRADE: Product Analysis, No Rating 
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...1, and Netscape Communications* SSL (Secure Sockets Layer) are 
highlighted in a discussion of digital certificates and the ways in which 



early users deploy them to cost-effectively secure business-to-business 
authentication . Random-number tokens, including SecurlD and RB-1, as well 
as biometric systems, and smart cards / are among technologies designed 
just for authentication - However, a technology getting more attention is 
public key infrastructure (PKI), which uses digital certificates and 
third-party certificate authorities to authenticate users and guarantee 
data integrity via public and private key encryption. PKI systems also 
maintain keys and certificates , revoke certificates when a user's 
status is altered, and manage certificate revocation lists. Businesses 
for which IDs and passwords are not secure enough are willing to spend 
the extra money for digital certificates , which have proved to be too 
expensive for the average online consumer transaction. Windows 2000 will 
provide native support for digital certificates . One current user of 
digital certificates , Scotiabank of Canada, issues digital certificates 
to online customers as a standard procedure, since customers wanted to use 
the Internet but were very concerned about security. They use the bank*s 
software to choose a password , which is stored on the customer's home PC, 
and a random number is generated to link the password and a digital 
certificate . SSL is the most popular security method for companies that 
conduct strictly e-commerce transactions. 
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Though smart cards can overcome the wealth of problems associated with 
faulty and porous password -based security systems, new hardware must also 
overcome a host of emerging standards and protocols before replacing 
passwords and PIN verification systems. Smart cards , electronic 
tokens, and intelligent keys are a few of the new hardware devices being 
developed that analysts say will eventually replace password systems. A 
host of smart card advocacy groups are working hard to push the new 
standards, and some smart card vendors are beginning to offer 
development tools that allow programmers to create custom card-based. . . 

...that do not allow a laptop to be powered up without one. Despite 
advances, the smart card industry still must overcome consumer doubts 
about financial and access security regarding any new technology. 
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...a new software product that will help online users create identities 
consisting of the various passwords each user must store, credit card 
numbers, phone numbers, and other personal information that allow users to 
then automatically fill out lengthy online registration forms and automate 
stacked password and authentication routines. Passport is a new 
technology that creates a digital wallet for each user and. . . 

...that allows users to create demographic and behavioral patterns and pass 
them along to sites certified by Privaseek that support the Platform for 
Privacy Preferences (P3) protocol that has not yet... 
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CyberCash's CashRegister acts as an intermediary between a store and a 
credit card issuer to allow Internet retailers to collect money online. 
The storefront site hosts a secure... 

...the retailer*s bank. The bank has its own software for working with 
CyberCash, and verifies the card, as it would for any store. However, the 
authorization is sent to CyberCash. . . 

...merchant, a 'working relationship' with a bank is required, along with 
merchant ID and terminal ID numbers with the bank. For those who do not 
have a bank, CyberCash provides assistance in... 
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...technology will speed up bulk mail delivery by making it possible for 
the USPS to authenticate and validate orders from mailers who sign 
their names on a digital pad, and send the captured. . . 

. . .data in encryption code before it is transmitted over the network. 
Biometric signatures can replace passwords and personal identification 
numbers , which can be forgotten or stolen, and it can also eliminate the 
need for smart cards , which can be lost or stolen. 

1998 



11/3, K/13 (Item 13 from file: 256) 

DIALOG (R) File 256 : Sof tBase : Reviews , Companies &Prods . 
(c)2001 Info. Sources Inc. All rts . reserv. 

00111197 DOCUMENT TYPE: Review 

PRODUCT NAMES: DaVinci Service Node (725463); N-Genius (725471); Shout! 
(725498) 

TITLE: Prepaid Calling Card Platforms — Hardware, Software Service Bureaus 
AUTHOR: Rowland, Elaine 

SOURCE: Teleconnect, vl6 n8 p88(4) Aug 1998 
ISSN: 0740-9354 

HOMEPAGE : http : / / www . teleconnect . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20001222 

...monitors calls. It also manages customer care and offers versatile 
billing options for prepaid cards, charge cards , and account customers. 
The latest release. Gateway 3, supports dynamic call control, various 
billing methods. . . 

...or call-through; it also provides the ability to choose carriers, 
provide sophisticated features, offer credit card authorization, and 
provide customer care. Gateway 3 runs on Windows NT 4.0 and uses... 

. . .public access networks in many parts of the world and supports many 
applications, including prepaid PIN and prepaid wireless, credit card 

validation / and voice over Internet protocol. Shout! provides prepaid 
calling cards that allow children to telephone. . . 
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...and Security Dynamics* ACE/Server with SecurlD are highlighted in a 
buyers' guide to network authentication products. Two types of products 
with powerful authentication methods are included: biometric products 
(which authenticate identity using a personal attribute of a user, such 
as a fingerprint, face, or voice) ; and token-enabled products (which use an 
actual token, such as a credit card -sized device, to authenticate 
identity) . For integration with Windows NT, SAF/nt is the best choice. The 
product demonstrates. . . 

...the standard NT domain utilities. The features operate in tandem with 
support for multiple biometric authentication methods. SAF/nt does not 
limit users to one type of biometric authentication . The Human 
Authentication application programming interface (API) allows use of any 
qualified Biometric Service Provider of voice, fingerprint... 

...while TrueFace provides face recognition. SecurlD, is token-based, and 
requires users to enter a passcode from a credit card -sized token. 
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...that the system cannot be compromised and that private shopper 
information is not stolen, including credit card information. To secure 
the browser, users can employ the Secure Sockets Layer standard and digital 
security certificates . Microsoft Internet Information Server (IIS) 



supports SSL 2,0, and VeriSign is an industry-leading certificate 
authority on the Internet. To secure the operating system and the file 
system, the NT . . . 

...to work with: standard, integrated, and mixed. Standard is the default 
and separates the logon validation scheme for user IDs and passwords 
from Windows NT. To secure a World Wide Web server, users should install a 
firewall . 
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RADIUS and TACACS+ are both implementations of expanded authentication 
services known as authentication , authorization, and accounting (AAA) . 
Both seek to centralize remote access management and create a single point 
of access and administration. Both RADIUS and TACACS+ encrypt their 
communications to protect passwords - And the protocols of the two have 
equivalent functions. The difference is that RADIUS is... 

...and TACACS+ protocols. Beyond these two protocols, a security system*s 
strength lies in its authentication policies. For example time-of-day 
restrictions and enforcement of usage quotas are important features that 
most AAA servers cannot support. Security is being enhanced by use of 
smartcards or one-time password generators. Products such as SecurlD 
from Security Dynamics Technologies use a credit -card -size device to 
generate random password strings. Other schemes depend upon a 
challenge/response algorithms. AAA proxy services are suggested for... 
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...SecurlD and lETF's Public Key Crypto System II are highlighted in a 
discussion of authentication tools that tell network managers who is 
logging on to their systems. Token card systems or smart card systems 
are two types of authentication systems that can be used. Tokens can run 
on any workstation, but they do not provide a digital signature and 
certificate functions, which are advantages provided by smart cards . 
Some token cards require users to enter multiple access codes before 
they grant entry. When researching both tokens and smart card products, 
users should find out if they will work with authorization servers based on 
such specifications as Remote Authentication Dial-In User Service 
(Radius) or if a new authorization server is required. Users should... 

...should know what the total installation costs will be. Tokens are likely 
to cost less; smart cards need special readers attached to each machine 
on the network, which considerably raises their cost... 

. . .Another large vendor is Vasco Data Security, which acquired many 
customers from Digital Pathways. Token authentication works with 
processors inside the token card that stores a group of secret encryption 
keys that generate one-time passcodes . 
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...Vendor*s servers are liable to attacks such as the attempted sale of 
86,326 valid credit card numbers for $260,000 which was uncovered by 
the FBI. The first line of defense... 

...against by a variety of means, such as locking up servers, restricting 
log-ons, changing passwords frequently, keeping logs of system 
activities, and making sure backups are securely stored. In addition. . . 
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E-mail is becoming a common method of transacting business, and a system o 
strong authentication is necessary to prevent abuse and fraud. 
Authentication provides a way to guarantee a sender's identity. 
Authentication can be based on an individual knowing or having something, 
such as a password or an electronic smart card , or can be based on 
some sort of biometrics such as taking an electronic fingerprint. There ar 
problems with basic password implementations; often, especially in UNIX 
systems, passwords are submitted from user to server in plain text. If a 
password is unencrypted, it can be easily captured by an attacker. The 
most basic type of protection is to encrypt passwords that pass over 
insecure channels such as the Internet. There are two types of encryption 

. . .messages that the public key decrypts and to decrypt messages encrypted 
by the public key. Certificate authorities (CAs) add to the security by 
connecting a principal to a public key to ensure its validity . 
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...and offers too little for a full VPN. ExtendNet VPN actually transmits 
both names and passwords in clear text with Password Authentication 
Protocol (PAP) . The most sophisticated data encryption possible with this 
system is Microsoft Challenge Handshake Authentication Protocol 
(MS-CHAP) . This is hardly the level of encryption needed to be 
state-of-the-art or to transmit sensitive corporate information or credit 

card numbers. Other indications of the product's backwardness are its us 
of DIP switches to... 
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...health data from the National Research Council's Computer Science and 
Telecommunications Board. Tokens are credit -card -sized devices with 
liquid crystal displays (LCDs) that display a different, randomly generated 
number every minute. A two-factor authentication process is used that 
incorporates the user*s logon name and personal identification nximber , 
and the random number generated by the SecurlD token. CareWeb also uses 
firewalls, RSA Data. . . 
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...to offer a secure payment system, lets shoppers open an account and \ r^*^ A 

receive a personal identification number (PIN ) . Purchases are then ) CKl^O<JiOM^ 

validated with the PIN . The actual credit card transaction is done / 
on a private secure network, not the Internet, making this an exceptionally I 

...to further promote electronic commerce. This is meant to be a universal f CjiKA-^ ^ 
standard for secure credit card transactions over the World Wide Web. \ 
SET identifies and verifies all parties involved in a transaction, then / 
uses encryption to carry out the actual funds... / 
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...tools also are vulnerable to attack. There are numerous techniques, some 
surprisingly simple, to steal credit card numbers and passwords , 
obtain account balances, and create phony transactions. The amount of 
Internet-related fraud is still... 

...Encryption ensures that sensitive information is protected if the 
message is intercepted, and digital signatures verify the authenticity 
of the message and its sender. Electronic attacks differ from other older 
types of attack . . . 
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CyberCash 's CyberCash, CyberCoin, and Digital Newsstand, First Virtual 's 
Virtual PIN (found in its First Virtual Internet Payment System), and 
DigiCash *s namesake product are electronic... 

...electronic commerce scenario. To be useful for representing real money, 
e-cash has to be validatable r nonrepudiatable, and private. CyberCash 
processes credit card transactions at the point of sale, and has more 
users than any other current method. . . 

...Sun Microsystems to use CyberCash' s digital wallet technology in their 
products, CyberCash software encrypts credit card information online 
and sends it to the merchant. The merchant adds his encrypted confirmation 

and sends it to CyberCash, which decodes the invoice and sends the 
transaction through the. . . 

, . .mail, with a VirtualPIN number, and DigiCash requires users to send 
money obtained with a credit card or an ATM to a bank that issues 
e-cash. Then the bank sends back... 
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...network security made up of firewalls, secure gateways, cryptographic 
algorithms at the browser and desktop, PINs , passwords , and other 
security measures. SSL is a security technology that uses public key 
cryptography, which. . . 

...SET adds a digital signature to SSL for unassailable proof that the 
bearer of a credit -card number is authentic . SET can help merchants 
avoid current money-losing scenarios in which people say they did not order 
an item or service on a particular credit card number that was given to 
a merchant. 
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V-ONE's SmartWall, a dual-homed application-level gateway firewall, uses 
mutual authentication for security and encryption for remote access and 
administration of more than one firewall and. . . 

...filter part or all of traffic attempting to move between networks. 
SmartWall uses firewall and smart card technologies to make the network 
secure and allow access control to internal systems. Features provided, 
including mutual authentication , session encryption, and secure telnet 
functions, block spoofing and other types of access by unsanctioned users. 
A challenge response system is used that employs one-use password tokens 



to ensure the authenticity of a user before access is allowed. Proxies 
are automatically activated when a session is... 
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Digital certificates , a new technology, can also be called digital 
signatures or digital IDs. They provide a higher level of security than 
standard user IDs or password schemes, and will be used to improve the 
ability of users to authenticate senders and receivers of 
network-transmitted information. An analyst predicts an explosion in the 
digital certificate market in the next two years, as more and more 
corporate staff and Internet users employ digital certificates to 
identify and authenticate themselves. The question of who will issue and 
maintain digital certificates is an important one to be resolved. While 
users have a comfort level when using standard forms of ID, such as credit 

cards and drivers* licenses, this surety is not available in the 
electronic environment. Users have to go through a credit check to get a 
digital certificate , and the issuer of a digital certificate can keep a 
copy of the digital certificate , along with a copy of all the issuee's 
personal information. Verisign is the principal issuer of digital 
certificates , with about a half million issued. The certificate can be 
shown to an Internet merchant, for instance, and the merchant checks with 
Verisign to authenticate the certificate , and then bills for goods or 
services . 
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...requires users to download an electronic wallet. The user then registers 
online to have identify validated . Banks supporting CyberCoin offer 
accounts that hold money transferred to the wallet, so the sum stays in the 
banking system's records. Other methods are credit -card purchases in 
which the seller's account is credited before the buyer's. NetCheque, an 
electronic check system, works the same way. Digicash's E-Cash and smart 
cards debit the buyer's account with money for later use. Mondex 
International's smart card system uses a wallet about the size of a 
pocket calculator that downloads small quantities of cash to a smart 
card . Transactions are anonymous, and Mondex readers can be attached to 
cash registers, kiosks, and computers... 

...hidden, encrypted information to prevent hackers from getting at private 
financial information, and to ensure authentication of buyers and sellers 
over the Internet. An alternative method is First Virtual Holdings' 
acquisition of credit -card numbers over the phone, with a personal 
identification number issued to users, and transactions confirmed by 
e-mail . 
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Verisign has the support of a wide cross-section of companies positioned to 
make digital certificate technology a mainstream computing activity early 
in 1997. VeriSign^s backers have equity in Verisign... 

...Lynch. The companies want to develop a broad-based infrastructure for 
securing electronic transactions. Digital certificates represent a huge 
future market, because they will become the sole method for providing 
access . . . 

...a large financial institution in New York. The need for a users to enter 
multiple passwords is eliminated, and AT&T is looking at ways to use 
digital certificate technology with its EasyCommerce system for 
implementation of enterprise-level commerce endeavors, or as embedded 
technology in a universal credit card . Digital certificates are 
primarily a method for providing a digital identification to users, says an 
AT&T. . . 

...on-board with Verisign include AT&T, with WorldNet Internet Access, Easy 
Commerce Services, and Universal Credit Card Service; Merrill Lynch, 
with Authenticated access to online brokerage accounts; Gemplus, with 
smart cards ; Intuit, with authenticated access to online financial 
services; Comcast, with @Home and QVS home shopping services; and 
Microsoft, with authenticated access to applications and services. 
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PRODUCT NAMES: SafeWord AS (608602); Access Builder (513202); NetWare 
4.x (699683); UNIX (699675); BandWagon (633143) 

TITLE: New tools authenticate remote users 

AUTHOR: McCarthy, Vance 

SOURCE: Datamation, v42 nl5 p92(4) Sep 1996 
ISSN: 0011-6963 

HOMEPAGE: http : //www. datamation . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20010222 

...Security's BandWagon are part of a brief discussion of new tools for 
remote user authentication . Andy Paul, manager of remote access services 
for Sun Microsystems, bolstered a two-phase authentication server 
soluti on with SafeWord AS, an authentication package that employs the 
vendor's multiplatf orm authentication server with a credit -card -sized 
automatic password generator. Ken Cutler, VP and director of security 
training for the Information Security Institute, says today's users need 
stronger authentication than ever before; he advises using front-end 
authentication , if the environment requires users to call the system 
frequently on an 800 number. Two-phase systems provide high-quality 
front-end authentication using two components, a one-time use password 
and a dedicated authentication server that holds a user/password 
database. Topics covered include management tasks, costs, security 
requirements, and outsourcing. 
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PRODUCT NAMES: SET (836281) 

TITLE: Internet Commerce SET for Takeoff 

AUTHOR: Tadjer, Rivka 

SOURCE: Computer Shopper, vl6 n7 p626(4) Jul 1996 
ISSN: 0886-0556 

HOMEPAGE : http : //www. computershopper . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20010331 

...been selected, users select a method of payment, sign their names 
digitally, and enter a password . The security of this transaction is 
based on the SET-encrypted ID number called a digital certificate , 
which protects against credit card fraud. Before being issued a SET ID, 



consumers go through a certification process in which each user's credit 
card is registered, 
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00088297 DOCUMENT TYPE: Review 

PRODUCT NAMES: Internet Security (841944) 

TITLE: Better to Be » Net-Safe Than Sorry 

AUTHOR: Schuman, Evan 

SOURCE: Communications Week, v594 p23(2) Jan 29, 1996 
ISSN: 0746-8121 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20010730 

...part of an attempt to detect and eliminate flaws. If a company allows 
outside access, authentication software is necessary. One-time passwords 

are often effective. Another technique is use of a credit intermediary, 
which removes the merchant from having to receive the credit card 
number . 
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PRODUCT NAMES: ACE/ Client for NetWare (546224); SecurPC (546232); 
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TITLE: Security products flood net market 

AUTHOR: Anthes, Gary H 

SOURCE: Computerworld, v29 n4 p61(l) Jan 23, 1995 
ISSN: 0010-4841 

HOMEPAGE: http : //www. computerworld . com 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20010730 

...and mobile computing. Security Dynamics Technologies now offers a 
NetWare client version of its SecurlD smart card system that generates 
onetime passwords . The ACE/Client for NetWare product allows remote users 
to access a Novell LAN, by entering a personal identification nxamber 
and a temporary password on a handheld device. RSA Data Security's RSA 
Secure is hard disk encryption software. . . 

...by employees who are not available to decrypt them. Surety Technologies* 
Digital Notary System can certify the contents and time of creation of a 
digital record, including those that may be... 
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00073970 DOCUMENT TYPE: Review 

PRODUCT NAMES: IBM Network Security Program (NetSP) (493791) 

TITLE: Sign On and Be Safe 

AUTHOR: Johnson, Johna Till 

SOURCE: Data Communications, v24 nl pl22(2) Jan 1995 
ISSN: 0363-6399 

RECORD TYPE: Review 

REVIEW TYPE: Product Analysis 

GRADE: Product Analysis, No Rating 

REVISION DATE: 20000930 

...network security product that provides uncompromising security 
functions. These include a single sign-on with password encryption and 
third party user authentication ; security is provided for MVS and VM 
mainframe applications guarded by IBM Resource Access Control... 

...and OS/2 LAN Server access is automatic during the first NetSP log-in, 
and 'smart card * security can also be used, including the SecurlD 
credit -card sized device. 
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00066826 DOCUMENT TYPE: Review 

PRODUCT NAMES: Company - IBM Corp (850225) ; Company - Security Dynamics 
Inc (857858) 

TITLE: IBM, Security Dynamics Ink Access -Control Deal 

AUTHOR: Smalley, Eric 

SOURCE: PC Week, vll n33 pl2(l) Aug 22, 1994 
ISSN: 0740-1604 

RECORD TYPE: Review 
REVIEW TYPE: Company 

REVISION DATE: 19990130 

IBM*s NetSP (Network Security Program) single log-on and authentication 
scheme will be made interoperable with Security Dynamics SecurlD system. 
SecurlD adds safety to single log-on systems. The Security Dynamics system 
uses a smart card and server, and provides a randomly generated number 
that the user enters with a personal ID number - NetSP gives users 
passkeys to grant access to any server on the network without having to 
enter an ID or password . The alliance will bring higher security to 
network operating systems. 
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09199462 

Firm claims breakthrough in payment by phonetechnology 

IRELAND: FULLY ENCRYPTED WAP PAYMENT SYSTEM 
Irish Times (IT) 19 Nov 1999 Business p. 14 
Language: ENGLISH 

...to be made over mobile phones. It has recently unveiled WAP Wallet which 
only releases credit card details when the user is authenticated and 
the merchant connection is secure. After registration through Network 365 *s 
website, the user selects a PIN code which is used when making purchases 

Network 365 is termed a 'Commerce Service Provider', or CSP, meaning 
that it designs and hosts... 
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09095441 

Citibank launches e-trade service for businesses 

ASIA- PACIFIC: CITIBANK STARTS E-COMMERCE SERVICE 
Business Times (XBA) 27 Apr 1999 p. 2 
Language : ENGLI SH 

American Citibank has launched Citibank Commerce, an electronic commerce 

service for transactions between businesses, in Asia-Pacific. The service 
will connect buyers and suppliers on -line , enabling the former to' 
view different product catalogues, submit orders, view and manage their 
invoices . . . 

... and manage data on their receivable and renew their credit lines. 
Clients will need a smart card , a password and a digital certificate 

to access Citbank Commerce. Transactions and information are protected by 
the triple DES 56 bit... 

...and client. The bank is putting in around US$ 160-170 mn a year in e - 
commerce business solutions. It will release the new service to Europe, 

America and Latin America later. 
1999 
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09085310 

High potential, big delays 

US: SMART CARDS ON THE INTERNET MAY BE SUPERSEDED 
Financial Times (FT) 07 Apr 1999 ITsupplmtp . viii 
Language: ENGLISH 

Smart cards offers a way to gain security authentication on the 

internet. It brings portability to e-mail, e -commerce , online banking 
and subscription based internet services. It contains a tamper proof 
computer processor embedded in the card. However, the smart card itself 
is protected by a personal identification number but this in the future 
may be replaced by a biometric measure such as a fingerprint. The smart 

card can be inserted to the PC while the PiN is keyed in. Payment 
security on the internet is understood as a weakness. However, the internet 
will not wait for smart cards to become useful preferring to go its on 
way. 
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09056133 

Authentic8ting users the key to smart-card success 

AUSTRALIA: AUTHENTIC8 INTO SMART CARD 
The Australian (XAA) 02 Feb 1999 Computers p. 36 
Language: ENGLISH 

Australia's AuthenticS has released a range of public key infrastructure 
(PKI) products aiming at corporate sector e -coiranerce . Its Card and Key 
Management System (CDMS) package would enable enterprise customers to fix 
the. . . 

...on mechanism on enterprise networks. They also enable customers to 
access network services with a smart card and PIN . 
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06534986 

Dacom to offer electronic payment service for Internet shoppers 

SOUTH KOREA: DACOM TO DEBUT PAYMENT SERVICE 
The Korea Herald (XBF) 18 Oct 1997 P. 7 

Language: ENGLISH 



South Koreans Dacom will introduce a secure, credit card -based 

electronic payment service for Internet shoppers on 20 October 1997. 
The electronic payment system is secure as it is based on an user 
authentication procedure, a feature that other current Internet 
shopping services do not have. The company has also developed an 
encryption software program, named Dacom Wallet, that provides almost 
perfect security to Internet shoppers - The new service is initially 
available to users of the company's Magic Link Home... 

. . . available to users of other home shopping malls when they are linked toN 
Dacom' s credit card authentication system. Users need to download 

Dacom Wallet software from the Magic Link home page and install it in their 
personal computers. They must then register their IDs and passwords with 
D acom' s electron ic paymg^nt .q^rvpr and put their bank account numbers or 
credit card numbers into Dacom Wallet. When use^rs click the it^ they 

want to buy , the software is automatically implemented and waii-f^^£ r i K nrnKQ 
to enter tKeir pass words . Typing in a password means a user wants to 

provides the new service together with three 



buy the 
credit 



item, 
card 



The company 
firms - Samsung, Korea Exchange Bank and LG. 
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06474032 

La 'red* comenza a sser segura para realizar pagos 

SPAIN: CERTIFICATION FOR ELECTRONIC COMMERCE 
La Gaceta de los Negocios (ZDA) 26 May 1997 p. 39 
Language: SP7\NISH 



A company that will issue electronic certificates to verify 

authenticity of payments through electronic commerce has been set up 
in Spain under the name Agenda de Certif icaciones Electronicas (ACE) by 
the savings bank confederation Ceca (20%), telecoms operator Telefonica 
(40%), and payment system companies Sistema 4B (20%) and Visa Espana (20%). 
The digital certificates issued by ACE will have secret numbers that will 
act in much the same way as the credit card PIN number. Banks will 
charge Pta 500 per certificate to users and establishments. Massive use 
of the system is expected to get underway in... 
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02510222 

JACK COMMITTEE REPORTS ON ELECTRONIC BANKING 

UK - JACK COMMITTEE REPORTS ON ELECTRONIC BANKING 
Financial Times (C) 1991 (FT) 24 February 1989 p7 

... committee identifies four difficulties in electronic funds transfer: 
countermanding or reversing instructions; guaranteeing operational 
security; authentication of instructions; and liability for loss in cases 
of failure or fraud. The committee recomends . . . 

for regulation of electronic funds transfer but recognises the 
difficulty in finding an alternative to PINs . A table details and 
forecasts money transmission volumes by electronic, plastic, and paper 
means in. . . 

... 1978 65% of payments were made through cheques, this has fallen to 57% 
in 1987, credit card payment has become increasingly important rating 
11% in 1987 compared with 4% in 1978, payment. . . 

...in 1987 compared with 9% in 1978. The report recommends that EFT systems 
be made on - line in order to reduce fraud and it suggests banks 
should introduce arrangements to monitor ATM withdrawal patterns... 

1989 
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6522406 INSPEC Abstract Number: C2000-04-7120-035 
Title: Biometrics electronic purse 
Author (s): Wahab, A.; Tan, E.C.; Heng, S.M. 

Author Affiliation: Div. of Comput . Syst., Nanyang Technol . Univ., 
Singapore 

Conference Title: Proceedings of IEEE. IEEE Region 10 Conference. TENCON 
99. 'Multimedia Technology for Asia-Pacific Information Infrastructure' 
(Cat. NO.99CH37030) Part vol.2 p. 958-61 vol.2 

Publisher: IEEE, Piscataway, NJ, USA 

Publication Date: 1999 Country of Publication: USA 2 vol . xxxvii+1583 
pp. 

ISBN: 0 7803 5739 6 Material Identity Number: XX-2000-00029 

U.S. Copyright Clearance Center Code: 0 7803 5739 6/99/$10.00 

Conference Title: Proceedings of IEEE. IEEE Region 10 Conference. TENCON 

99. 'Multimedia Technology for Asia-Pacific Information Infrastructure' 
Conference Sponsor: Inst. Electron Eng. Korea; Korea Inf. Sci. Soc; 

Korean Inst. Electr, Eng.; Korean Inst. Commun. Sci.; IEEE Region 10; 

Minist. Sci. & Technol.; Minist. Educ; Cheju Province 

Conference Date: 15-17 Sept. 1999 Conference Location: Cheju Island, 



South Korea 

Language: English 
Subfile: C 
Copyright 2000, lEE 

Abstract: This paper proposes an efficient and universal smart card 
system to be implemented for banking applications over the Internet to 
support the fast growing electronic commerce industry. Encryption 

technology such as digital certificates and signatures were exploited and 
integrated with other authentication specifications (e.g. SET) to provide 
secure transactions over a distributed network. A simple PiN code 
verification is no longer sufficient and would require a more complex and 
fool proof authentication method. A 56-bit DES encryption algorithm can 
easily be broken in just 2 to... 

... CRACKER, an unclassified ASIC machine. This paper looks into using 
biometrics as a means of authentication , thus requiring a new generation 
of smart card technology to be implemented in banking and a multiple 

applications environment. A prototype of the... 
1999 
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5741715 INSPEC Abstract Number: C9712-6130S-045 

Title: Internet security, the next generation. When software encryption is 
not enough 

Author (s): Goldman, J. 

Journal: WEB Techniques vol.2, no. 11 p. 43-6 
Publisher: Miller Freeman, 

Publication Date: Nov. 1997 Country of Publication: USA 

CODEN: WETEFA ISSN: 1086-556X 

SICI : 1086-556X(199711)2: IIL. 43:ISNG;1-B 

Material Identity Number: F184-97010 

Language: English 

Subfile: C 

Copyright 1997, lEE 

...Abstract: their site's transactions by configuring and running a 
secure server using Verisign's digital certificates and the secure 
sockets layer (SSL) . This scheme authenticates the server to the user and 
encrypts the data sent following the initial negotiation; however, it does 
not provide an end-to-end framework that automatically authenticates both 
client and server. The multiplicity of a person's passwords may be the 
reason that electronic commerce has taken off so slowly. However, 

smart -card technology is rapidly becoming a viable option for securing 
systems. The cards have a personal identification number so that onle 
their owners can use them, and they perform cryptography; no unencrypted 
data. . . 
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5504020 INSPEC Abstract Number: B9704-6120B-006, C9704-7120-008 
Title: Locking the e-safe 
Author (s ) : Baldwin, R.W. ; Chang, C.V. 

Author Affiliation: RSA Data Security Inc., Redwood City, CA, USA 
Journal: IEEE Spectrum vol.34, no. 2 p. 40-6 
Publisher: IEEE, 

Publication Date: Feb. 1997 Country of Publication: USA 

CODEN: lEESAM ISSN: 0018-9235 
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Material Identity Number: 1094-97002 

U.S. Copyright Clearance Center Code: 0018-9235/97/$10 . 00 
Language: English 
Subfile: B C 
Copyright 1997, lEE 

...Abstract: boredom. Fear of these risks has created a demand for 
security features built directly into electronic commerce systems. The 
good news is that existing security mechanisms can be combined to minimize 
a wide range of threats to electronic commerce . Security isn't the only 
problem. European banks will soon have electronic stored value cards 
that are as good as cash. Forgetting the password for a stored value 
card could be as troublesome as losing a wallet. The mechanisms used to 
solve security problems can be divided into four areas-privacy, 
authentication , integrity, and scalability- though a single mechanism can 
often mitigate more than one kind of... 
1997 
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5405830 INSPEC Abstract Number: B9612-6210L-050, C9612- 6130S-012 
Title: Use of smart cards for security applications by Deutsche Telekom 

Author(s): Kowalski, B. 

Author Affiliation: Deutsche Telekom AG, Germany 

Conference Title: Mobile Communications. Technology, Tools, Applications, 
Authentication and Security. IFIP World Confe rence on Mobile Communications 
p. 245-6 

Editor(s): Encarnacao, J.L.; Rabey, J.M. 
Publisher: Chapman & Hall, London, UK 

Publication Date: 1996 Country of Publication: UK ix+342 pp. 
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Conference Title: Proceedings of 1996 World Conference on Mobile 
Communications 

Conference Date: 2-6 Sept. 1996 Conference Location: Canberra, ACT,' 
Australia 

Language: English 
Subfile: B C 
Copyright 1996, lEE 

Abstract: Smart cards will be a key technology for secure electronic 
commerce and electronic payment applications on the Internet. They offer 
the unique advantage of keeping cryptographic mechanisms securely in 
tamper-proof equipment. Smart cards will be used for access control 

instead of passwords , for the generation of digital signatures, for 
encryption/decryption, as an electronic purse and as a repository of any 
confidential information. Several years ago smart cards were mostly 
used at card telephones and for banking applications and their usage was 
restricted. . . 

... ATMs. With the introduction of the health insurance card in Germany the 
first multi-application smart card terminals for PCs appeared on the 
market. Since 1993, prices for PC smart card interfaces have dropped 
dramatically and made the card terminal a standard device for PC-hardware 



... A security platform has been developed consisting of a number of 
security components like a smart card , a smart card terminal, a 
trusted third party for key management, a high speed PCMCIA encryption 
card, various authentication and encryption terminals and a security 
management system. The smart card plays a key role in Telekom's 

information security strategy. The card includes a public... 
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Privacy and security on the Internet: how to secure your personal 
information and compsLXiy data 

Attaran, Mohsen; VanLaar, Ilja 

Information Management & Computer Security , December 1, 1999 , v7 n5 
p241-246, 6 Page(s) 
ISSN: 0968-5227 

... passwords. Warns against opening attachments or downloading files 
from unknown sources. Suggests the following for online shopping : use a 
secure Web connection, request firewall protection, get Secure Electronic 
Transfer (SET), deal with trusted companies, pay by credit or charge 

card , verify the seller's identity, ask about Includes one table and a 
list of references, (amg) 
1999 
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Dutch secure payments with SET 

D'Amico, Mary Lisbeth 
Computerworld , August 3, 1998 
ISSN: 0010-4841 
Product Name: Secure Electronic Transaction 



v32 n31 p42, 1 Page(s) 



Focuses on a new payment option available for Dutch customers buying 
over the Internet , known as the Secure Electronic Transaction (SET) 
protocol. Explains that SET, which is designed to... 

...browser-based plug-in downloaded to a customer *s PC that lets users send 
encrypted credit card information. Notes that SET was developed by Visa 
International and MasterCard International, and includes a certification 
authority which generates and controls digital certificates and 
cryptographic keys. Adds that the payment gateway links the merchant's 
World Wide Web. . . 



. . . implement, and says that merchants have preferred the rival SSL 
protocol, which encrypts only users* credit card and ID numbers . 
1998 
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2192428 H.W. WILSON RECORD NUMBER: BAST00069380 
Signing on the digital line 
Elliott, John; 

lEE Review v. 45 no5 (Sept. 16 1999) p. 222-5 
DOCUMENT TYPE: Feature Article ISSN: 0953-5683 

ABSTRACT: Technologies used to verify the identity of parties involved 
in e -commerce transactions are examined. Smart cards can be used 
not only to confirm identity but also to play a direct part in the 
payment process. The use of a password or biometric measurement, ensures 
that the smart card is being used by its rightful owner. 
1999 
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1998001 H.W. WILSON RECORD NUMBER: BAST98065628 

System-on-silicon creates new paths for biometric applications 

Computer Design v. 37 no9 (Sept. 1998) p. 15+ 
DOCUMENT TYPE: Feature Article ISSN: 0010-4566 

...ABSTRACT: to become the next extension to the user interface as it 
increases the security of electronic commerce . Encoding biometric 
information, such as voice, fingerprint, facial, and retinal 
characteristics, with smart cards provides increased security without 
the need for personal identification numbers or passwords . 
Developments made by various companies in the field of biometric 
identification and verification are described. 
1998 
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Microsoft designs keys for *net security 
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...TEXT: include the following: * Certificate Server, which sits on top of 
CryptoAPI and issues and manages certificates under user-specified 
policies. * Digital Wallet, which holds a user's passwords , credit - 
card numbers, certificates , private keys and other vital data for 
electronic commerce • The contents of the wallet are encrypted; in this 
way, the contents can be safely. . . 
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Debit cards move to the fore 
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within next five years; Dove Assoc reports that consumers are expected to 
make 7.3 bil online and offline debit card transactions in 1999) 
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TEXT: 

...The iris identification number will be linked in a secure server to the 
consumer *s bank cards and PIN . A camera package will enable online 
shoppers to validate their ATM cards instantly. 

Korman said that Cash Technologies would demonstrate the system in the 
first quarter of. . . 
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Internet Commerce: Show Me the Money 

(Credit card issuers and merchant bankers could see a huge gain in profit 
as the number of Internet transactions rises but there are also risks) 
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TEXT: 

...when they register with First Virtual and use that personal 
identification number to authorize all purchases with First Virtual 
retailers . 



The retailer gets only a customer's name, address and pin , and never sees 
a credit card number . The ^^tfi'^lfir t rrin*=Tn1i1-s the J>IN to First 
Virtual, wnicn confirms^ with the shopper via electronic mail tli31r- the 
transaction is valid , then confirms and collects payment from the card 
issuer. First Virtual then ascertains the purchase with the retailer 
and forwards payment after the product has been shipped in the case... 
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TEXT: 

...over an encrypted link. 

Still, 85 percent of people do not want to transmit their credit card 
numbers across cyberspace, experts said. So companies use personal 
identification numbers for on -line payments. ISN confirms orders 

twice via E-mail and, like conventional credit card companies, it 
surveys accounts for unusual activity, said ISN marketing vice president 
Bill Rollinson. 
Legal . , . 
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GEMPLUS NCD: Gemplus And NCD To Demonstrate Java -Based Smart Card 
Authentication At Comdex 

June 02, 1997 
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. . .network access and electronic commerce 
applications require far more security than can be provided by 

password authentication alone. Smart cards provide this level of 
security through hardware-based tamper-resistant tokens that out 
perform software. . . 
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...the millions of people who will be 
conducting commerce on the Internet," 

Just as personal identification numbers are used to protect 
credit cards , Certificate Authorities are tomorrow's mechanism for 

protecting electronic commerce . Companies that provide services such 

as electronic banking, data interchanges and credit card purchases 
are . , . 
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Electronic commerce. (Technology Information) 
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... cybercash.com). Once a price is negotiated with the merchant, the \^ A 

customer is sent an on -line invoice detailing the purchase / 

information and a statement confirming the total charges. The customer I 

then adds a credit card number or debit card information, including J ^ "YYKUVLnAAih 

a PIN where appropriate. This information is encrypted and returned to / j 
the merchant with the original invoice... ^ tf % ( i 
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TEXT: 

...Corp. (FDC), Transaction Systems Architects (TSAI) and others will help 
develop the method for using smart cards , PIN numbers and digital 
signatures for validating purchases on the Internet or at physical 
points of sale. The program, which is to work for credit and. . . 
19991215 
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INTERNET PAYMENT COMPETITION HEATS UP 
Financial Services Report, vl3, nl5, pN/A 
July 17, 1996 

Language: English Record Type: Fulltext 
Document Type: Newsletter; Trade 
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mail, with approval and an 800 number. Through the toll-free 
number, consumers register their credit cards and receive confirmation 
of their PIN numbers. 

When making a purchase from a First Virtual merchant, consumers 
simply supply their VirtualPIN to the merchant, which then sends the 
product information. . . 
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...verify the identity of users accessing networks and e- commerce 
applications. The size of a credit card , e.iD Multicard combines 
digital certificates , encrypted secret key-based dynamic passwords and 
physical identity badging. The card can be customized to allow access to 
financial transactions... 
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driving the use of certificate authorities and digital signatures, 
Merenbloom said. Companies need to protect, validate and authenticate 
to conduct business electronically. Just as a personal identification 
number is used to protect credit cards , certificate authorities are 
the mechanism for protecting electronic commerce - 

"It's all about supporting commercial data exchange, and security is 
the enabling mechanism for... 
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... that resides on his computer's hard drive and holds critical 

financial data. When he orders an item online , he activates the digital 

certificate . The digital certificate acts as a password , much like a 
bank card *s personal identification n\iinber (PIN ), enabling the 
merchant's computer to verify that the account is valid before it passes 
along the protected account information to the... 
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... mail, with approval and an 800 number. Through the toll-free 

number, consumers register their credit cards and receive confirmation 
of their PiN numbers. 

When making a purchase from a First Virtual merchant, consumers 
simply supply their VirtualPIN to the merchant, which then sends the 
product information. . . 
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driving the use of certificate authorities and digital signatures, 
Merenbloom said. Companies need to protect, validate and authenticate 
to conduct business electronically. Just as a personal identification 
number is used to protect credit cards , certificate authorities are 
the mechanism for protecting electronic commerce . 

"It's all about supporting commercial data exchange, and security is 
the enabling mechanism for. . . 
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... were being received online. Soon, payments can be received online | 

by VSNL too, and the order confirmed online . 

The customer should give his credit card number to EVI, which will 
verify it and assign a personal identity number (piN ) to him. This 
number will be sufficient for the customer to. transact online on VSNL. . . 



